SOC for Cloud Environments CSA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC analyst is investigating a potential data exfiltration from a cloud storage bucket. The analyst sees a large number of 'GetObject' API calls from a single IP address over a short period. Which additional data point would most strongly indicate a real exfiltration rather than a legitimate bulk download?

   • AThe bucket is configured with versioning enabled
   • BThe bucket has a lifecycle policy that deletes old objects
   • CThe API calls were made using temporary credentials that were just issued
   • DThe IP address belongs to a known cloud provider
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC team wants to automatically detect and respond to misconfigured cloud resources, such as storage buckets with public access. Which cloud-native service should they use?

   • AVulnerability scanner for virtual machines
   • BCloud security posture management (CSPM) tool
   • CWeb application firewall
   • DNetwork intrusion detection system
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC team is responding to a ransomware incident that affected a cloud environment. The team needs to contain the spread while preserving evidence for potential legal action. Which approach best balances containment and evidence preservation?

   • AShut down all affected VMs immediately and then begin forensic analysis.
   • BDelete the affected VMs and restore from backups.
   • CDisconnect the cloud environment from the internet entirely.
   • DIsolate affected VMs by changing their security groups to block all traffic, and take snapshots of their disks before any further action.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is required to retain security logs for at least one year to comply with industry regulations. The company uses a cloud environment with ephemeral resources. Which approach ensures compliance?

   • AConfigure log export to a durable, immutable storage solution that retains logs for the required period.
   • BExport logs to a local on-premises server, but only for the most critical alerts.
   • CRely on the cloud provider's default log retention settings.
   • DStore logs on the ephemeral instances that generate them.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A forensic investigator is examining a cloud environment after a security incident. The investigator needs to collect evidence that is admissible in court. Which consideration is most important?

   • ACollect as much data as possible, including data from other tenants, to ensure completeness.
   • BEnsure that evidence is collected using a documented and repeatable process, including chain of custody and integrity verification.
   • CRely on the cloud provider's incident response team to handle all evidence collection.
   • DUse only cloud provider tools for evidence collection, as they are automatically admissible.
   Reveal Solution Discussion Select an answer first