SOC for Cloud Environments CSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC team wants to automate the initial response to a known malicious IP address attempting to access a cloud resource. Which approach is most effective?

   • AUse a cloud security orchestration, automation, and response (SOAR) playbook that automatically updates the network security group to block the IP.
   • BManually block the IP in the firewall after receiving an alert.
   • CCreate a static rule in the cloud provider's edge firewall that blocks all traffic from that IP.
   • DSend an email to the cloud administrator to request a block.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC analyst is configuring log collection for a cloud environment that uses serverless functions. Which log source is most important for detecting an attacker invoking functions with stolen credentials?

   • AApplication performance monitoring metrics
   • BNetwork flow logs for the function's virtual network
   • CCloud audit logs of the function's invocation API
   • DFunction execution logs
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of a cloud governance policy in a SOC context?

   • ATo eliminate the need for SOC monitoring
   • BTo increase cloud spending
   • CTo define rules for cloud resource usage and security controls
   • DTo automatically block all external traffic
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A healthcare organization stores patient data in a public cloud. The compliance team requires that all patient data remain within the country's borders. Which cloud configuration best satisfies this requirement?

   • ADeploy resources in a cloud region located within the country
   • BUse a private cloud deployment model
   • CEncrypt all data with customer-managed keys
   • DEnable multi-factor authentication for all users
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A SOC team is responding to a suspected compromise of a cloud workload. The incident involves a VM that is part of an auto-scaling group. The team needs to preserve evidence while also containing the threat. Which approach best balances these needs?

   • ADetach the VM from the auto-scaling group, take a snapshot of its disk, and then isolate it by changing its security group to block all traffic.
   • BTerminate the VM immediately and rely on the auto-scaling group to launch a new instance.
   • CTake a snapshot of the VM's disk and then allow the auto-scaling group to continue managing it.
   • DCopy the VM's memory to a file using a tool installed on the VM, then shut it down.
   Reveal Solution Discussion Select an answer first