Cloud Logging and Security Monitoring CSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which measure is most effective for preventing an attacker from altering logs after a security incident?

   • AUsing immutable storage for logs
   • BRotating logs daily
   • CStoring logs in the same location as the application
   • DCompressing logs to save space
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing Azure Monitor logs and notices a large number of failed sign-in attempts from a single IP address across multiple users, followed by a successful sign-in for one user. Which type of attack does this pattern most likely indicate?

   • AA distributed denial-of-service (DDoS) attack
   • BA brute-force or password-spraying attack
   • CA man-in-the-middle attack
   • DA SQL injection attack
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company uses Google Cloud and wants to detect when a user creates a new Identity and Access Management (IAM) role, which is a sensitive action. Which Google Cloud service should they use to monitor this activity?

   • AGoogle Cloud Security Command Center
   • BGoogle Cloud Monitoring
   • CGoogle Cloud Audit Logs
   • DGoogle Cloud Logging
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team wants to centralize logs from multiple AWS accounts into a single SIEM for monitoring. They also need to ensure that logs are not lost if the SIEM is temporarily unavailable. Which architecture best meets these requirements?

   • AEnable AWS Organizations and use the management account to view all logs in one place
   • BAggregate logs from all accounts into a central S3 bucket, then have the SIEM ingest from that bucket
   • CUse AWS CloudWatch Logs in each account and have the SIEM query each account separately
   • DConfigure each account to send logs directly to the SIEM via syslog
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating a potential breach. They need to determine which user account was used to create a new virtual machine, what time it was created, and from which IP address the API call originated. Which type of cloud log should the analyst examine first?

   • ANetwork flow logs
   • BAudit logs (control plane logs)
   • CAccess logs (data plane logs)
   • DApplication logs
   Reveal Solution Discussion Select an answer first