Security Operations in Cloud CCSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of integrating threat intelligence feeds into cloud security operations?

   • ATo replace the need for security monitoring tools
   • BTo guarantee that no security incidents will occur
   • CTo automatically patch all cloud vulnerabilities
   • DTo enhance the ability to detect and respond to known threats
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's SOC team wants to detect anomalous behavior in their cloud environment, such as unusual login patterns or data exfiltration. They have enabled logging for all cloud services. What is the next step to enable detection?

   • AOnly monitor logs from critical servers and ignore others.
   • BUse the cloud provider's default security alerts without customization.
   • CCreate baseline behavior profiles and set alerts for deviations from the baseline.
   • DManually review all logs at the end of each day.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company's SOC team needs to detect unauthorized access attempts across AWS, Azure, and on-premises workloads. They want a single dashboard to correlate logs and alert on suspicious sign-ins. The compliance team requires that all security logs be retained for at least one year and that access to the logging platform be logged. Which approach best meets these requirements?

   • ADeploy a centralized SIEM that ingests logs from all sources, configure retention policies for one year, and enable audit logging on the SIEM itself.
   • BEnable verbose logging on all resources and rely on the cloud provider's default retention settings.
   • CUse a single cloud provider's monitoring tool for all workloads, including on-premises, without additional configuration.
   • DStore logs in each cloud provider's native log service and have the SOC manually review each console daily.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During a suspected breach, a cloud security engineer needs to preserve forensic evidence from a compromised AWS EC2 instance. The instance is still running and the security team wants to minimize disruption while ensuring the evidence is preserved. Which action should the engineer take first?

   • ALog into the instance and copy log files to a local workstation.
   • BDetach the root volume and attach it to a forensic instance for analysis.
   • CTerminate the instance immediately to prevent further compromise.
   • DCreate a snapshot of the instance's EBS volumes and store it in a separate, controlled S3 bucket with restricted access.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's SOC team is setting up centralized logging for a multi-cloud environment that includes AWS, Azure, and on-premises servers. They need to correlate security events across all sources and enable real-time alerting. Which approach should they take?

   • AStore logs separately in each cloud provider's native log storage and manually review them during incident investigations.
   • BEnable logging only for the cloud provider with the most sensitive data and skip others.
   • CConfigure each cloud provider's native logging service to send all logs to a single SIEM platform via API integrations.
   • DUse only on-premises log collection and ignore cloud-native logs to reduce complexity.
   Reveal Solution Discussion Select an answer first