Auditing and Monitoring Cloud Resources CSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company must demonstrate continuous compliance with a security framework that requires specific configuration settings on their cloud virtual machines. They want to automatically detect any drift from those settings and receive alerts. Which solution best meets this requirement?

   • ACollect all VM logs into a central log store and have analysts manually search for misconfigurations.
   • BEnable basic monitoring of CPU and memory usage on the VMs and alert when usage exceeds a threshold.
   • CRun a manual configuration review of all VMs at the end of each quarter and document the results.
   • DUse a cloud security posture management tool that continuously evaluates VM configurations against the framework's built-in policies and alerts on violations.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a valid method for collecting audit evidence from cloud resources?

   • AAsking the cloud provider to verbally confirm compliance
   • BUsing a third-party tool to guess the configuration settings
   • CReviewing the cloud provider's marketing materials
   • DExporting configuration snapshots and activity logs from the cloud provider
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An audit finding shows that a cloud environment has several IAM users with unused permissions. The remediation plan must reduce risk without disrupting ongoing operations. Which approach is most appropriate?

   • ARemove the IAM users entirely and create new ones with the same permissions.
   • BUse automated tools to identify unused permissions, then remove them after a review period and monitor for any access issues.
   • CLeave the permissions in place but document them in the audit report.
   • DImmediately remove all permissions that have not been used in the last 30 days.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the typical first step in the remediation process after an audit identifies a compliance issue?

   • AIgnore the findings if they are minor
   • BImmediately delete all affected resources
   • CPrioritize the findings based on risk and impact
   • DReport the issue to the cloud provider for them to fix
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is planning its first cloud audit. The audit team has been asked to assess whether the organization's use of a SaaS HR application meets GDPR requirements. Which step should the team take FIRST when defining the audit scope?

   • AInterview all employees who use the HR application.
   • BCollect all logs from the SaaS provider for the past year.
   • CIdentify the specific GDPR controls and data flows that apply to the SaaS application.
   • DPurchase a compliance monitoring tool for the SaaS application.
   Reveal Solution Discussion Select an answer first