Security Operations in Cloud CCSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A financial services company must retain security logs for at least one year to meet regulatory requirements. They are using a cloud SIEM. What should they configure?

   • AExport logs to a public cloud storage bucket without access controls.
   • BStore all logs in the SIEM's hot storage indefinitely.
   • CDelete logs after 30 days to save storage costs.
   • DSet up log archiving to low-cost storage with a retention policy of one year.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security operations team is integrating multiple threat intelligence feeds into their SIEM. They notice that some feeds generate a high number of false positives, causing alert fatigue. The team wants to reduce noise while still detecting real threats. What is the best approach?

   • AIncrease the alert threshold for all feeds to the highest level to minimize alerts.
   • BRemove all threat intelligence feeds that generate any false positives.
   • CDisable all automated alerts and have analysts manually review each feed daily.
   • DAssign a confidence score to each feed and only trigger alerts when the score exceeds a threshold, while also correlating with internal context.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company wants to automate the containment of compromised user accounts in their cloud environment. When an account is flagged for suspicious activity, they want to automatically disable the account and require a password reset. What should they implement?

   • AManually disable the account after reviewing the alert in the SOC console.
   • BCreate a playbook that triggers on the alert, disables the user account via the cloud provider's API, and sends a notification to the user and the security team.
   • CSend an email to the user asking them to change their password.
   • DAutomatically delete the user account to ensure it cannot be used again.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company's SOC team wants to ensure that all cloud API calls are logged and that the logs are tamper-evident. They are using AWS CloudTrail and want to protect the logs from unauthorized modification. Which configuration should they implement?

   • ADisable CloudTrail logging for read-only API calls to reduce log volume.
   • BEnable CloudTrail log file validation and store logs in an S3 bucket with a bucket policy that denies delete and overwrite permissions.
   • CEnable CloudTrail and allow all IAM users to access the logs for transparency.
   • DStore CloudTrail logs in the same S3 bucket as application data for convenience.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company wants to automate incident response for common threats but is concerned about the risk of automated actions causing unintended damage. They want to ensure that any automated response can be quickly reversed if it causes issues. Which approach should they take?

   • AAvoid automation entirely and rely on manual response to prevent any risk of unintended damage.
   • BAutomate only destructive actions, such as terminating instances, to quickly eliminate threats.
   • CDesign playbooks that use reversible actions, such as isolating a VM by changing its network security group, and log all actions for audit.
   • DUse automation only for actions that require no permissions, such as sending notifications.
   Reveal Solution Discussion Select an answer first