Security Operations in Cloud CCSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which of the following is a common source of security-relevant logs in a cloud environment?

   • ACloud provider's employee badge access logs
   • BInternet service provider's network traffic logs
   • CCloud provider's physical data center cooling logs
   • DVirtual machine guest operating system logs
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a cloud-specific challenge that incident response procedures must address?

   • AInability to isolate compromised workloads
   • BLimited ability to capture network packets at the hypervisor level
   • CNo need to consider data residency during investigations
   • DLack of logging capabilities in cloud services
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A security operations team is integrating multiple threat intelligence feeds into their SIEM. Some feeds have overlapping indicators, and some are of lower quality. They want to reduce false positives while maintaining high detection coverage. What is the best strategy?

   • AUse a scoring system that weights indicators based on feed reliability and recency.
   • BManually review each indicator before adding it to the SIEM.
   • CUse only the feed with the most indicators.
   • DImport all indicators equally and alert on any match.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security operations team wants to integrate threat intelligence into their cloud security monitoring, but they are concerned about the privacy of their internal IP addresses being exposed to the threat intelligence provider. What is the best way to mitigate this?

   • AShare all internal IP addresses with the provider to get better intelligence.
   • BUse a threat intelligence platform that supports on-premises or private deployment, or anonymize internal IPs before sharing.
   • COnly use free threat intelligence feeds that do not require sharing data.
   • DAvoid using threat intelligence altogether.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company's security operations team wants to automate the initial triage of security alerts to reduce analyst workload. They have a SIEM and a SOAR platform. What is the best approach?

   • AAutomatically close all low-severity alerts without review.
   • BHave analysts manually review every alert in the SIEM queue.
   • CDisable all alerts that are not critical to reduce noise.
   • DCreate a SOAR playbook that enriches alerts with threat intelligence and assigns a severity score before notifying analysts.
   Reveal Solution Discussion Select an answer first