Security Operations in Cloud CCSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A cloud security team wants to reduce the time to respond to common alerts, such as an instance being exposed to the internet with an open management port. They want to automate the initial response while still allowing human approval for destructive actions. Which approach should they implement?

   • AHave the SOC manually investigate each alert and apply fixes through the console.
   • BConfigure the cloud provider to automatically terminate any instance that triggers the alert.
   • CSet up an email alert that requires an analyst to manually run a script to block the port.
   • DCreate a security playbook that automatically applies a restrictive security group to the instance and sends a notification to the SOC for further action.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is establishing a SOC for its cloud environment. They want to ensure that the SOC can effectively detect and respond to incidents across multiple cloud providers. What is a key function they must implement?

   • AFocus only on the cloud provider with the most critical assets.
   • BRely solely on cloud provider's default security alerts.
   • CCentralized log aggregation and monitoring from all cloud providers.
   • DSeparate SOC teams for each cloud provider with no shared visibility.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary benefit of using automation in cloud security operations?

   • ARemoving the need for security monitoring tools
   • BReducing the time to detect and respond to security incidents
   • CEliminating the need for human security analysts
   • DGuaranteeing that all security incidents are prevented
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security operations team wants to automatically block traffic from known malicious IP addresses in their cloud environment. They have subscribed to a threat intelligence feed that provides updated IP reputation data. Which approach should they use to integrate this feed into their security operations?

   • AIngest the threat feed into their SIEM and create automated playbooks that update firewall rules or WAF policies to block the IPs.
   • BManually add the IPs to a blocklist each time the feed updates.
   • CStore the threat feed in a database and require analysts to check it before approving traffic.
   • DUse the threat feed only for post-incident analysis and reporting.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is building a SOC for a hybrid cloud environment. They have limited staff and need to decide how to structure their SOC to provide 24/7 coverage without excessive cost. They are considering using a managed security service provider (MSSP) for after-hours monitoring. What is the best approach?

   • AOutsource all security operations to an MSSP and eliminate the internal security team.
   • BUse an MSSP for 24/7 monitoring and alert triage, while keeping an internal team for incident response and complex investigations.
   • CHire a full internal 24/7 SOC team to maintain complete control over all security operations.
   • DRely solely on automated tools and alerts without any human monitoring after hours.
   Reveal Solution Discussion Select an answer first