Security Operations in Cloud CCSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations team wants to enrich their cloud security monitoring with external threat intelligence to detect known malicious IP addresses and domains. They use a SIEM that supports custom threat intelligence feeds. What is the most effective way to integrate this?

   • ABlock all IP addresses from the threat feed at the cloud firewall without testing.
   • BManually check each alert against a threat intelligence website during investigation.
   • CStore the threat feed in a spreadsheet and review it weekly.
   • DImport threat intelligence feeds into the SIEM and create correlation rules that alert on matches with cloud logs.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's security operations team needs to demonstrate compliance with an industry framework that requires continuous monitoring and regular review of security logs. They want to automate the evidence collection process. What should they implement?

   • ARely on the cloud provider's compliance reports as evidence of the company's own controls.
   • BStore logs in a secure location and provide access to auditors upon request.
   • CManually export logs and create reports at the end of each quarter.
   • DUse a compliance automation tool that continuously collects logs, checks them against the framework's controls, and generates audit reports.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key difference in incident response between traditional on-premises environments and cloud environments?

   • ACloud environments do not require incident response plans
   • BCloud providers handle all incident response activities
   • CIncident responders may need to rely on cloud provider tools and APIs for evidence collection
   • DIncident response in the cloud is always faster and simpler
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security operations team is troubleshooting why they are not receiving alerts for a specific type of attack in their cloud environment. They have enabled logging and set up alerts, but no alerts are firing. What is the most likely cause?

   • AThe log source is not sending logs to the SIEM due to a misconfigured log forwarding agent.
   • BThe SIEM is not licensed for that type of alert.
   • CThe alert severity is set too high, so it is being suppressed.
   • DThe attack is not occurring in the environment.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A cloud security team wants to reduce response time for common incidents like unauthorized API calls. They have a SIEM that can trigger webhooks. What should they implement?

   • AA SOAR playbook that automatically isolates the affected resource and opens a ticket for human review.
   • BA script that permanently deletes the affected resource without any notification.
   • CAn email alert to the security team with no automated action.
   • DA manual process where analysts check SIEM alerts every hour and respond.
   Reveal Solution Discussion Select an answer first