A financial institution is required to retain audit logs for seven years for compliance. The logs are stored in a cloud object storage service. The compliance team also requires that logs be immutable to prevent tampering. Which configuration best meets both requirements?

Copy logs to multiple regions for redundancy

Enable object lock with retention mode set to 'Compliance' for seven years

Encrypt the logs with customer-managed keys

Store logs in a standard storage tier and rely on access permissions

A SOC team wants to automate the detection and response to a specific type of attack: a user account making unusual API calls that indicate potential credential compromise. The team has a SOAR platform and access to cloud APIs. Which automation approach is most effective?

Set up an email alert that notifies the SOC analyst, who then manually investigates and responds.

Create a static rule that blocks all API calls from that user account.

Create a playbook that monitors cloud API logs, uses a baseline of normal behavior, and automatically triggers a response such as disabling the account or requiring MFA.

Use a third-party tool that requires manual configuration for each new user.

A SOC analyst detects that a cloud storage bucket has been made publicly readable, exposing sensitive data. Which immediate action is most appropriate?

Contact the cloud provider to request a rollback of the bucket's configuration.

Wait for the next compliance scan to identify the issue.

Delete the bucket and all its contents.

Change the bucket's access policy to private and then assess the exposure.

A forensic investigator needs to collect evidence from a cloud VM that was involved in an incident. The VM is scheduled to be deleted in a few hours. What is the most important first step?

Contact the cloud provider to request physical access to the underlying server.

Wait for the VM to be deleted and then recover it from the recycle bin.

Run a full forensic imaging tool inside the VM.

Create a snapshot of the VM's disk and store it in a separate, controlled location.

EC-CouncilCertified SOC Analyst

Domain 6Objective 3

SOC for Cloud Environments CSA Practice Questions (Page 7)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

50questions here

10free pages

7concepts

Questions 31–35

31expert · hard
A financial institution is required to retain audit logs for seven years for compliance. The logs are stored in a cloud object storage service. The compliance team also requires that logs be immutable to prevent tampering. Which configuration best meets both requirements?
Select an answer first
32expert · hard
A SOC team wants to automate the detection and response to a specific type of attack: a user account making unusual API calls that indicate potential credential compromise. The team has a SOAR platform and access to cloud APIs. Which automation approach is most effective?
Select an answer first
33application · medium
A SOC analyst detects that a cloud storage bucket has been made publicly readable, exposing sensitive data. Which immediate action is most appropriate?
Select an answer first
34application · medium
A forensic investigator needs to collect evidence from a cloud VM that was involved in an incident. The VM is scheduled to be deleted in a few hours. What is the most important first step?
Select an answer first
35foundation · easy
What type of cloud log records user activity, such as who accessed a resource, from which IP address, and what actions were performed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.