Auditing and Monitoring Cloud Resources CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is certified under ISO 27001 and must demonstrate continuous improvement of its cloud security controls. They currently perform annual internal audits. An external auditor suggests that annual audits are insufficient for continuous improvement. Which change best aligns with the concept of continuous monitoring?

   • AImplement automated compliance checks that run continuously and feed results into a risk register that is reviewed monthly.
   • BRely on the external auditor's annual assessment to identify improvements.
   • CIncrease the frequency of internal audits to twice a year.
   • DDocument that the annual audit is sufficient and no changes are needed.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of an audit report in the context of cloud auditing?

   • ATo automatically fix all identified issues
   • BTo communicate audit findings and recommendations to stakeholders
   • CTo provide a marketing summary of the cloud provider's services
   • DTo replace the need for future audits
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which statement best describes the relationship between cloud auditing and cloud governance?

   • ACloud auditing is a one-time activity that establishes governance rules
   • BCloud auditing provides independent verification that governance policies are being followed
   • CCloud auditing and cloud governance are unrelated because auditing is only for financial reporting
   • DCloud auditing defines the policies and procedures that cloud governance enforces
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company uses a multi-cloud environment with workloads on AWS and Azure. The security team needs a single dashboard to detect unusual API calls, track configuration changes, and alert on failed login attempts across both providers. They want to use native cloud services where possible, but they also need a unified view. Which approach best meets the requirement?

   • ARely on the cloud providers' built-in dashboards separately and manually compare them weekly.
   • BEnable AWS CloudTrail and Azure Monitor, then export both to a central SIEM such as Microsoft Sentinel or a third-party tool.
   • CConfigure Azure Policy to monitor AWS resources and send alerts to the Azure Security Center.
   • DUse only AWS CloudTrail for all environments because it can capture activity from Azure resources through its API.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company operates in a region where data residency laws require personal data to remain within the country. They use a public cloud provider that offers multiple regions globally. They are planning their auditing and monitoring strategy. Which consideration is most critical?

   • AStore logs only in the cloud provider's default region.
   • BEncrypt logs so that they can be stored anywhere without restriction.
   • CEnsure that all logs containing personal data are stored and processed in a region within the required country.
   • DUse a single global region for all logs to simplify management.
   Reveal Solution Discussion Select an answer first