SOC for Cloud Environments CSA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC team is designing log collection for a cloud environment that uses both IaaS VMs and serverless functions. The team wants to minimize cost while ensuring security-relevant events are captured. Which strategy is most cost-effective?

   • AEnable audit logs for all services and store them in a low-cost archival tier
   • BStore all logs in a high-performance analytics tier indefinitely
   • CDisable logging for serverless functions to save cost
   • DCollect only VM guest OS logs and ignore audit logs
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A SOC team wants to automate the response to a detected cloud misconfiguration, such as a storage bucket becoming public. The team must ensure that the automation does not disrupt legitimate business operations. Which approach best balances automation and safety?

   • AOnly send an alert and take no automated action
   • BAutomatically delete the bucket
   • CAutomatically shut down all resources in the account
   • DAutomatically apply a remediation that reverts the bucket to private and notify the owner
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC analyst is reviewing cloud audit logs and sees a service account that normally authenticates from a specific IP range is now authenticating from a new geographic region at 3:00 AM. The analyst also sees a large number of 'List' and 'Get' API calls to a sensitive database. Which detection technique is most appropriate to flag this activity?

   • ANetwork intrusion detection on the virtual network
   • BAnomaly detection based on user and entity behavior analytics (UEBA)
   • CSignature-based detection for known malware
   • DYARA rule matching on file contents
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC team wants to automatically quarantine a compromised cloud VM by applying a network security group rule that blocks all inbound and outbound traffic. Which automation approach is most appropriate?

   • AAsk the VM's administrator to shut down the VM
   • BCreate a new VM to replace the compromised one
   • CManually edit the NSG through the portal
   • DUse a runbook that calls the cloud provider's API to update the NSG
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC analyst needs to detect a potential credential-stuffing attack against a cloud web application. Which cloud-native logging source is most directly useful for this detection?

   • ABilling and cost management reports.
   • BApplication-level authentication logs that record successful and failed login attempts with source IP addresses.
   • CDNS query logs from the corporate network.
   • DCloud provider's infrastructure metrics such as CPU utilization and network throughput.
   Reveal Solution Discussion Select an answer first