A SOC analyst is investigating a potential account compromise in a cloud environment. The analyst sees that a user account has been used to create a new access key and then used that key to access a database. Which detection technique would most effectively identify this type of attack?

Monitor for the creation of access keys followed by unusual data access

Monitor for network traffic to known malicious IPs

Monitor for changes to the user's password

Monitor for failed login attempts

A company is subject to GDPR and must ensure that personal data of EU citizens is not transferred outside the EU without appropriate safeguards. The company uses a public cloud provider with regions in the EU and the US. Which approach is most compliant?

Store EU personal data in the US region but encrypt it with strong encryption.

Use a single global region and rely on the provider's compliance certifications.

Store all data on-premises in the EU, regardless of cloud strategy.

Store and process EU personal data only in an EU region, and ensure that any data transfers outside the EU are covered by appropriate safeguards such as standard contractual clauses.

During a cloud incident, the SOC team must contain a compromised VM that is part of a critical application. The team has limited time and must choose between two actions: (1) isolate the VM by updating the network security group, or (2) take a snapshot of the VM before isolation. Which sequence is most appropriate?

Only take a snapshot and do not isolate

Only isolate the VM and skip the snapshot

Take a snapshot first, then isolate the VM

Isolate the VM first, then take a snapshot

A company must store customer personal data in a specific geographic region to comply with data residency regulations. Which cloud configuration is most appropriate?

Use a global cloud service and rely on encryption to protect the data.

Store data on-premises in the company's data center, regardless of cloud strategy.

Use a cloud provider that offers a 'sovereign cloud' option, but only if it is available in the required region.

Deploy the application and data storage in a cloud region that is physically located within the required country or jurisdiction.

A SOC analyst sees a series of failed login attempts to the cloud management console followed by a successful login from a new IP address. The analyst wants to detect this pattern automatically in the future. Which approach is most effective?

Disable the management console after one failed login

Create a correlation rule that triggers on multiple failed logins followed by a success

Block all logins from new IP addresses

EC-CouncilCertified SOC Analyst

Domain 6Objective 3

SOC for Cloud Environments CSA Practice Questions (Page 4)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

50questions here

10free pages

7concepts

Questions 16–20

16expert · hard
A SOC analyst is investigating a potential account compromise in a cloud environment. The analyst sees that a user account has been used to create a new access key and then used that key to access a database. Which detection technique would most effectively identify this type of attack?
Select an answer first
17expert · hard
A company is subject to GDPR and must ensure that personal data of EU citizens is not transferred outside the EU without appropriate safeguards. The company uses a public cloud provider with regions in the EU and the US. Which approach is most compliant?
Select an answer first
18expert · hard
During a cloud incident, the SOC team must contain a compromised VM that is part of a critical application. The team has limited time and must choose between two actions: (1) isolate the VM by updating the network security group, or (2) take a snapshot of the VM before isolation. Which sequence is most appropriate?
Select an answer first
19application · medium
A company must store customer personal data in a specific geographic region to comply with data residency regulations. Which cloud configuration is most appropriate?
Select an answer first
20application · medium
A SOC analyst sees a series of failed login attempts to the cloud management console followed by a successful login from a new IP address. The analyst wants to detect this pattern automatically in the future. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.