Security Operations in Cloud CCSE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company wants to automate the containment of compromised cloud resources, but they are concerned about the risk of automatically isolating a production resource that is critical to business operations. What is the best way to implement automation while minimizing risk?

   • AUse a SOAR playbook that automatically isolates resources only if the alert severity is high and the resource is not in a protected group.
   • BAutomatically isolate resources but only during off-peak hours.
   • CDo not automate isolation; always require manual action.
   • DAutomatically isolate all resources that trigger any alert.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A healthcare company must comply with HIPAA and needs to ensure that their cloud security monitoring does not violate patient privacy. They want to monitor for unauthorized access to protected health information (PHI) while minimizing exposure of PHI in logs. What should they do?

   • AImplement logging that captures metadata and access patterns without including the actual PHI content, and restrict access to logs to authorized personnel.
   • BDisable logging for all systems that process PHI to avoid any risk of exposure.
   • CLog all PHI data in full to ensure complete visibility for security analysis.
   • DStore logs in a public cloud bucket for easy access by security tools.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team wants to automatically update their firewall rules when new malicious IPs are identified by their threat intelligence feed. They are using a cloud firewall service that supports API-based rule updates. What is the best way to implement this?

   • AUse the threat feed only for reporting and not for active blocking.
   • BManually update the firewall rules every time the threat feed is updated.
   • CExport the threat feed to a file and have the firewall import it periodically.
   • DCreate a script or serverless function that polls the threat feed API and updates the firewall rules automatically when new indicators are found.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A healthcare organization stores patient data in a public cloud and must comply with HIPAA. The security operations team needs to ensure that logging and monitoring do not violate compliance requirements. What should they do?

   • ADisable logging to avoid storing sensitive information in logs.
   • BEnable detailed logging for all access to patient data and restrict access to logs to authorized personnel.
   • CLog only successful access attempts and ignore failures.
   • DStore logs in a public bucket for easy access by auditors.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company wants to automate incident response for common threats, but compliance regulations require human approval for any action that could impact data availability. They are using a SOAR platform. What is the best way to balance automation and compliance?

   • AAutomate low-risk actions like alert enrichment and ticket creation, but require manual approval for containment actions.
   • BAutomate all actions, including containment, without human review.
   • CAutomate containment but log the action for later compliance review.
   • DDo not use automation; have analysts manually perform all steps.
   Reveal Solution Discussion Select an answer first