Security Operations in Cloud CCSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team wants to enrich their cloud security alerts with external threat intelligence to identify known malicious actors. They have a threat intelligence platform (TIP) that aggregates multiple feeds. What is the best way to integrate this with their cloud monitoring?

   • AUse the TIP's API to feed indicators into the SIEM and cloud-native detection services, such as AWS GuardDuty or Azure Sentinel.
   • BSubscribe to the TIP's email alerts and forward them to the SOC mailbox.
   • CHave analysts manually copy indicators from the TIP into the cloud console when investigating alerts.
   • DExport the threat intelligence feed to a CSV file and upload it to the cloud storage for reference.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company's cloud environment is experiencing a security incident. The SOC team is using a SIEM to analyze logs, but the volume of logs is overwhelming and they are missing critical alerts. They need to improve the signal-to-noise ratio. Which approach is most effective?

   • AIncrease the severity level of all alerts to ensure they are noticed.
   • BDisable all alerts and have analysts manually search logs during the incident.
   • CImplement log filtering and correlation rules that focus on known attack patterns and high-risk assets, and tune alert thresholds based on baseline behavior.
   • DCollect more logs from all sources to ensure no data is missed.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an example of a compliance requirement that affects cloud security operations?

   • ADeploying all workloads in a single region
   • BUsing a specific cloud provider
   • CRetaining security logs for a specified period
   • DEliminating all security alerts
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of implementing centralized logging in a cloud environment?

   • ATo reduce storage costs by compressing all log files
   • BTo provide a single source of truth for security monitoring and incident investigation
   • CTo replace the need for identity and access management
   • DTo automatically patch vulnerabilities in cloud workloads
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A multinational company must comply with GDPR for EU customer data and also with local data residency laws that require data to stay within the country. They are designing their cloud security operations. What is the best approach?

   • AEncrypt logs and store them anywhere, claiming encryption satisfies compliance.
   • BStore all logs in a central region outside the country for easier management.
   • CUse a third-party SIEM hosted in a different country and rely on contractual agreements.
   • DDeploy logging and monitoring infrastructure in the same region as the data and restrict access to authorized personnel.
   Reveal Solution Discussion Select an answer first