Incident Response in Cloud CCSE Practice Questions (Page 12)

Questions 56–57

1. 56application · medium

   A security operations center (SOC) wants to automate the initial triage of security alerts from multiple cloud providers. They want to enrich alerts with threat intelligence and automatically create a ticket in their ticketing system. Which approach should they use?

   • AUse a simple email distribution list to forward alerts to the SOC team.
   • BConfigure each cloud provider's native alerting to send notifications to a chat application.
   • CManually review each alert and create tickets in the ticketing system.
   • DUse a cloud-native SIEM like Azure Sentinel or AWS Security Hub with built-in automation rules and playbooks that integrate with the ticketing system.
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   When correlating logs from multiple cloud services to determine the scope of an incident, which of the following is the most important factor to consider?

   • AThe timestamps and time zones used in the logs
   • BThe color scheme of the cloud provider's dashboard
   • CThe cost of the cloud services involved
   • DThe geographic location of the cloud data centers
   Reveal Solution Discussion Select an answer first