Auditing and Monitoring Cloud Resources CSE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   During an investigation, an auditor needs to prove that a specific user deleted a virtual machine in Azure. The organization has Azure Activity Logs enabled, but the logs are only retained for 90 days. The incident occurred 6 months ago. What should the organization do to obtain the evidence?

   • ACheck if the Activity Logs were exported to a Log Analytics workspace or storage account with a longer retention period.
   • BAsk the cloud provider to recover the deleted logs from their internal systems.
   • CUse Azure Resource Manager's deployment history to see who deleted the VM.
   • DAccept that the evidence is lost and note it in the audit report.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company runs a containerized application on a cloud platform. The operations team wants to monitor the health of the application and also capture events related to container restarts and scheduling decisions. Which combination of monitoring data should they collect?

   • AMetrics such as CPU and memory usage, plus logs and events from the container orchestration platform.
   • BOnly the network traffic logs from the load balancer.
   • COnly the application's business metrics, such as number of transactions per second.
   • DOnly the cloud provider's billing reports to track resource consumption.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A DevOps team wants to be notified when CPU utilization on a critical application server exceeds 85% for 10 minutes. They also want to see historical trends. Which combination of cloud monitoring features should they use?

   • AA log-based alert that scans application logs for the word 'CPU'.
   • BA metric alarm that triggers a notification, plus a dashboard that displays the metric over time.
   • CA resource group tag that triggers an email when the server is tagged.
   • DA configuration rule that checks if the server has enough vCPUs.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company uses a cloud security posture management (CSPM) tool that generates hundreds of compliance findings daily. The security team is overwhelmed and cannot manually review every finding. They need to reduce noise while still ensuring that critical misconfigurations are addressed. What is the best approach?

   • AConfigure the CSPM tool to suppress findings for resources that are already covered by a compensating control, and set up automated remediation for high-severity findings that match known-safe patterns.
   • BIncrease the severity threshold so that only findings labeled 'critical' are reported, and ignore all others.
   • CAssign all findings to a single analyst to review and manually remediate each one.
   • DDisable all CSPM alerts and rely on quarterly manual audits to identify misconfigurations.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A startup wants to automate compliance checks for its AWS environment without building custom scripts. They need to detect resources that violate internal policies, such as S3 buckets with public access, and automatically generate reports. Which AWS service is designed for this?

   • AAWS CloudTrail
   • BAWS Config
   • CAWS Trusted Advisor
   • DAmazon CloudWatch
   Reveal Solution Discussion Select an answer first