Cloud Logging and Security Monitoring CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A healthcare organization must retain access logs for six years to comply with HIPAA. They currently store logs in a cloud log management service that only retains data for 30 days. What is the most cost-effective way to meet the retention requirement while preserving the ability to query recent logs?

   • ADelete logs after 30 days and rely on the SIEM's summary reports for compliance.
   • BStore logs on a local server in the office for six years.
   • CIncrease the retention period of the log management service to six years for all logs.
   • DExport logs to a cloud object storage service with lifecycle policies to transition to cold storage after 30 days, and keep them there for six years.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which regulatory standard specifically requires organizations to maintain an audit trail of access to protected health information?

   • AISO 27001
   • BHIPAA
   • CGDPR
   • DPCI-DSS
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company uses Azure and wants to monitor for suspicious sign-in activity, such as impossible travel (logins from different geographic locations in a short time). Which Azure service should they use to analyze sign-in logs?

   • AAzure Activity Log
   • BMicrosoft Entra ID (Azure AD) sign-in logs
   • CAzure Network Watcher logs
   • DAzure Monitor metrics
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which Azure service provides a unified platform for collecting and analyzing logs and metrics from Azure resources?

   • AAzure Monitor
   • BAzure Security Center
   • CAzure Active Directory
   • DAzure Key Vault
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is reviewing AWS CloudTrail logs and notices that a Lambda function is being invoked every few minutes, but the function is not part of any known application. What should the analyst do first?

   • ADisable the function's trigger and monitor for further activity
   • BCheck the function's code and execution role to determine what it does and what resources it can access
   • CIgnore the activity because Lambda functions are often used for automation
   • DDelete the Lambda function immediately
   Reveal Solution Discussion Select an answer first