Cloud Logging and Security Monitoring CSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is preparing for a PCI-DSS audit. They need to demonstrate that their cloud logging system prevents logs from being altered. What should they implement?

   • AEnable write-once-read-many (WORM) storage for log archives.
   • BEncrypt logs with a strong encryption algorithm.
   • CStore logs in a relational database with foreign key constraints.
   • DUse a log management service with default settings.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company uses a third-party SIEM for centralized monitoring. They want to ingest VPC flow logs, CloudTrail logs, and GuardDuty findings from AWS. Which approach is the most efficient and reliable for getting these logs into the SIEM?

   • AUse AWS Lambda to manually copy logs from each source to the SIEM on a daily basis
   • BEnable VPC flow logs to be delivered directly to the SIEM's syslog port
   • CConfigure each log source to send data directly to the SIEM via its native integration
   • DUse a centralized log aggregation service (e.g., Amazon S3) and have the SIEM pull from that service
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which compliance requirement is most directly addressed by ensuring cloud logs are retained for a specified period and are accessible for audit?

   • APCI-DSS logging requirements
   • BSOC 2 Type I report
   • CGDPR data minimization
   • DISO 27001 certification
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is subject to multiple compliance frameworks with conflicting log retention requirements: one requires logs to be kept for 1 year, another for 7 years. They want to minimize storage costs while staying compliant. What is the best approach?

   • ARetain all logs for 7 years to satisfy the most stringent requirement.
   • BKeep logs for 1 year and rely on the fact that the 7-year requirement is not enforced.
   • CStore all logs in cold storage for 7 years, but only keep metadata for 1 year.
   • DClassify logs by data type and apply the appropriate retention period for each, keeping the longest required for each category.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company uses Google Cloud and wants to detect anomalous behavior such as a user downloading a large number of files from a storage bucket. They have enabled Cloud Audit Logs and are considering using Google Cloud's Security Command Center. Which approach would be most effective for detecting this specific behavior?

   • ARely on Security Command Center's built-in anomaly detection
   • BCreate a log-based metric in Cloud Logging that counts the number of downloads per user and alert when it exceeds a threshold
   • CUse Cloud Monitoring to track storage bucket metrics
   • DEnable Cloud IDS and monitor network traffic
   Reveal Solution Discussion Select an answer first