SOC for Cloud Environments CSA Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   In the shared responsibility model for cloud services, which party is responsible for securing the physical data center that hosts the cloud infrastructure?

   • ABoth parties equally
   • BThe cloud customer
   • CThe cloud service provider
   • DA third-party auditor
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which cloud-native service is specifically designed to collect and analyze activity logs from cloud resources, such as virtual machines and storage accounts, for security monitoring?

   • ACloud load balancer
   • BCloud DNS service
   • CCloud monitoring service
   • DCloud object storage
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A SOC analyst is reviewing a new cloud deployment that uses a private cloud model. Which statement best describes the security implications for the SOC?

   • APrivate cloud is always more secure than public cloud, so compliance requirements are automatically met.
   • BThe organization has exclusive use of the cloud infrastructure, but the SOC still needs to monitor and respond to threats within that environment.
   • CPrivate cloud automatically provides dedicated physical hardware, which eliminates the need for monitoring.
   • DThe cloud provider is fully responsible for all security, so the SOC can focus on other tasks.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A SOC analyst is investigating a potential misconfiguration in a cloud environment. The analyst notices that a security group allows inbound SSH from any IP address (0.0.0.0/0). Which action is most appropriate?

   • ADelete the security group and create a new one with the same rules.
   • BRestrict the security group to only allow SSH from known administrative IP addresses, and then review logs for any unauthorized access.
   • CLeave the security group as is, but enable detailed monitoring for SSH traffic.
   • DImmediately terminate all instances associated with the security group.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   During a cloud incident, a SOC analyst needs to preserve evidence from a compromised virtual machine. The VM is running a critical application and cannot be stopped immediately. Which action best preserves forensic evidence while minimizing disruption?

   • AAttach the VM's disk to another VM for analysis
   • BCreate a snapshot of the VM's disks
   • CReboot the VM to clear any malware from memory
   • DDelete the VM immediately to prevent further compromise
   Reveal Solution Discussion Select an answer first