Security Operations in Cloud CCSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an example of a threat intelligence feed that can be integrated into cloud security operations?

   • AA list of cloud pricing tiers and billing options
   • BA list of known malicious IP addresses and domains
   • CA list of all cloud service regions and availability zones
   • DA list of cloud provider employee names
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During a security incident in a cloud environment, the incident response team needs to preserve volatile evidence from a compromised virtual machine while minimizing disruption to business operations. What should they do first?

   • ATake a snapshot of the VM's disk and capture memory dump before isolating the VM from the network.
   • BDelete the VM and restore from the last known good backup.
   • CImmediately shut down the VM to prevent further damage and then collect logs.
   • DDisconnect the VM from the network without capturing any data first.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is establishing a SOC for its multi-cloud environment. The SOC team is small and wants to prioritize monitoring efforts. They have limited budget and need to detect the most critical threats. Which strategy should they adopt?

   • AFocus on monitoring high-risk assets and use threat intelligence to prioritize alerts based on relevance to the organization.
   • BDeploy monitoring only in the cloud provider where the most data is stored.
   • CUse only free monitoring tools and rely on the SOC team to manually review logs.
   • DMonitor all assets equally and collect as much data as possible to avoid missing anything.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company's incident response plan is being updated to address cloud-specific challenges. The plan must account for the shared responsibility model and the need to coordinate with the cloud provider during an incident. What is the most critical element to include?

   • ADefine roles and responsibilities for the customer and the cloud provider, including escalation paths and procedures for requesting provider assistance.
   • BInclude a list of all cloud provider support phone numbers and expect them to handle the incident.
   • CState that the cloud provider is responsible for all security incidents in the cloud.
   • DFocus only on customer-controlled aspects and ignore provider responsibilities.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A global company must comply with GDPR and needs to monitor for potential data breaches involving personal data. They use multiple cloud providers and need to ensure that monitoring and incident response processes align with GDPR requirements. What is the most important consideration?

   • AEncrypt all monitoring logs to protect personal data in transit and at rest.
   • BStore all monitoring logs in the same region as the data to avoid data transfer issues.
   • CEnsure that monitoring and incident response processes include timely notification to the relevant supervisory authority and affected individuals when required.
   • DUse only cloud providers that are GDPR-certified to ensure compliance.
   Reveal Solution Discussion Select an answer first