Security Operations in Cloud CCSE Practice Questions (Page 10)

Questions 46–48

1. 46application · medium

   During a ransomware incident, a company's cloud workloads are being encrypted. The incident response team needs to contain the spread while preserving evidence for legal action. What is the best immediate action?

   • ADisconnect the instances from the internet but leave internal network access open.
   • BIsolate affected workloads by applying network security group rules to block traffic, while keeping the instances running.
   • CPower off all affected instances immediately.
   • DDelete the affected instances and restore from backups.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company is building a SOC for a hybrid cloud environment. They have limited staffing and need to prioritize monitoring efforts. They want to detect advanced threats while minimizing false positives. What is the best strategy?

   • AUse only manual monitoring by analysts without any automation.
   • BFocus only on cloud assets and ignore on-premises systems.
   • CMonitor all assets equally with default alerts.
   • DUse a risk-based approach to prioritize monitoring of high-value assets and apply threat intelligence to reduce false positives.
   Reveal Solution Discussion Select an answer first
3. 48application · medium

   A security operations team wants to automatically block traffic from known malicious IP addresses at the cloud firewall. They have a threat intelligence feed that updates frequently. What is the most effective way to implement this?

   • AIgnore the feed and rely on the cloud provider's built-in DDoS protection.
   • BManually update the firewall rules every time the feed changes.
   • CUse a firewall rule that references the threat intelligence feed and updates automatically.
   • DBlock all traffic from countries listed in the threat feed.
   Reveal Solution Discussion Select an answer first