Auditing and Monitoring Cloud Resources CSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company runs a containerized application on Amazon ECS. They need to monitor both the underlying EC2 instances and the application containers. They want a single tool to view metrics and logs from both layers. Which approach is most effective?

   • AUse only EC2 instance metrics and ignore container-level metrics.
   • BEnable VPC Flow Logs and use them to infer container health.
   • CUse a third-party tool that only monitors containers, not the underlying instances.
   • DUse Amazon CloudWatch with the CloudWatch Agent and the ECS container insights feature.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is under investigation and must provide audit evidence from a cloud environment. The evidence includes logs that are stored in a log management system that allows any administrator to delete logs. The legal team requires that the evidence be admissible in court. What should the company do to ensure the evidence is preserved and admissible?

   • ARely on the log management system's built-in reports as evidence, even though logs can be deleted.
   • BAsk the administrator who discovered the issue to keep the logs in their personal drive until the investigation is complete.
   • CImmediately copy the relevant logs to an immutable, access-controlled storage location and document the chain of custody, including who accessed the logs and when.
   • DDelete the logs after taking screenshots to reduce the risk of tampering.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company's cloud environment is subject to a compliance framework that requires annual audits. The company also wants to implement continuous monitoring to reduce the risk of non-compliance between audits. How should the company view the relationship between annual audits and continuous monitoring?

   • AContinuous monitoring is only useful during the audit period and can be disabled otherwise.
   • BContinuous monitoring replaces the need for annual audits, since it provides real-time data.
   • CContinuous monitoring supplements annual audits by providing ongoing assurance and early detection of compliance drift, while audits provide formal verification.
   • DAnnual audits are only needed if continuous monitoring detects a problem.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is planning an audit of its cloud environment to meet both PCI DSS and GDPR requirements. The audit team has limited resources and must prioritize. The PCI DSS scope includes cardholder data environments, while GDPR applies to all personal data. How should the audit team scope the audit to address both frameworks efficiently?

   • AScope the audit to all systems in the cloud environment, regardless of whether they process cardholder or personal data.
   • BDefine a single audit scope that covers all systems processing either cardholder data or personal data, and map each control to the relevant framework requirement.
   • CScope the audit only to the cardholder data environment, since PCI DSS is more prescriptive than GDPR.
   • DConduct two completely separate audits: one for PCI DSS and one for GDPR, with no overlap in evidence collection.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses a cloud object storage service for sensitive documents. To meet a regulatory requirement, they must be able to prove who accessed each document and when, for the past 12 months. What should they configure?

   • AUse a third-party tool that periodically scans the storage service and reports the current file permissions.
   • BEnable management-plane audit logs for the storage account and retain them for 30 days.
   • CEnable data-plane access logging on the storage service and export the logs to an immutable, long-term retention store.
   • DEnable verbose logging on the application that uses the storage service and store those logs in the application's database.
   Reveal Solution Discussion Select an answer first