Cloud Logging and Security Monitoring CSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key consideration when defining a log retention policy in the cloud?

   • ARetaining logs only for the shortest possible time
   • BBalancing storage cost with compliance and investigation needs
   • CUsing the same retention period for all log types
   • DStoring all logs indefinitely regardless of cost
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is subject to GDPR and must be able to delete personal data upon request. However, they also have a legal obligation to retain audit logs for two years. How should they handle this conflict?

   • AIgnore the deletion request because the logs are required for security
   • BRetain the logs for two years but restrict access to them and document the legal basis for retention
   • CAnonymize the personal data in the logs while retaining the rest of the log content
   • DDelete all logs that contain personal data immediately upon request
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a common source of security-relevant logs in a cloud environment?

   • AMarketing analytics reports
   • BUser interface themes
   • CVirtual machine operating system logs
   • DBilling invoices
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is reviewing logs to understand a potential data breach. They need to see who accessed a specific file in a cloud storage bucket, when, and from what IP address. Which type of log should they examine?

   • AAudit logs (control plane logs)
   • BApplication logs
   • CAccess logs (data plane logs)
   • DNetwork flow logs
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company operates in a hybrid cloud environment with workloads in AWS and Azure. They want to centralize security monitoring in a single SIEM. The SIEM supports both AWS CloudTrail and Azure Activity Log as native sources. However, the company also needs to include logs from custom applications running on EC2 and Azure VMs. What is the most efficient way to get these application logs into the SIEM?

   • AConfigure each VM to write logs to a shared cloud storage bucket, and have the SIEM poll that bucket periodically.
   • BInstall a log agent on each VM that forwards application logs directly to the SIEM's ingestion endpoint.
   • CUse AWS CloudTrail and Azure Activity Log to capture application logs.
   • DUse a third-party log shipper that only supports AWS, and manually export Azure logs.
   Reveal Solution Discussion Select an answer first