SOC for Cloud Environments CSA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is a key challenge in cloud forensics due to the ephemeral nature of cloud resources?

   • ACloud resources are immune to tampering
   • BEvidence may be lost when resources are terminated
   • CCloud providers always retain data indefinitely
   • DForensic tools cannot run in the cloud
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company migrates a customer-facing web application to a public cloud IaaS deployment. The SOC team is asked to define monitoring coverage for the new environment. Which responsibility falls to the SOC team under the shared responsibility model?

   • AEnsuring the cloud provider's network firewalls are updated
   • BConfiguring the cloud provider's physical data center security cameras
   • CEnabling and monitoring the guest OS and application logs on the virtual machines
   • DPatching the hypervisor that hosts the virtual machines
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is adopting a hybrid cloud model, with some workloads on-premises and some in a public cloud. The SOC team needs to ensure consistent monitoring and threat detection across both environments. Which approach is most effective?

   • ADeploy a SIEM that ingests logs from both on-premises and cloud sources, and use consistent detection rules across both.
   • BUse the same cloud-native logging service for both environments by sending on-premises logs to the cloud.
   • CMonitor the cloud environment with cloud-native tools and the on-premises environment with separate tools, then manually correlate.
   • DFocus monitoring on the cloud environment because it is more likely to be attacked.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SOC analyst notices that a cloud storage bucket suddenly becomes publicly readable. The analyst wants to determine whether the change was made by an authorized administrator or an attacker. Which cloud-native log source should the analyst query first?

   • AVirtual network flow logs
   • BDNS query logs
   • CCloud audit logs (e.g., CloudTrail, Activity Log)
   • DLoad balancer access logs
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SOC analyst notices a cloud service account is making API calls to list and download objects from an S3 bucket at unusual hours. The account has never performed these actions before. Which detection technique is most appropriate?

   • AImmediately disable the account without further investigation.
   • BReview the account's IAM policy to see if it has permission to list objects.
   • CCheck the account's password age and force a password reset.
   • DCreate a baseline of normal API activity for the account and alert on deviations from that baseline.
   Reveal Solution Discussion Select an answer first