Cloud Logging and Security Monitoring CSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A cloud security team wants to collect logs from multiple virtual machines and storage buckets into a central location for analysis. Which approach is commonly used to aggregate these logs?

   • AConfigure each resource to stream logs to a centralized logging service
   • BUse a single log file shared across all resources
   • CManually download logs from each resource to a local server
   • DEnable verbose logging on the network firewall
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is integrating AWS CloudTrail logs into their SIEM. They notice that the SIEM is not receiving logs for some API calls, particularly those made by the root account. What is the most likely cause?

   • AThe SIEM's CloudTrail integration is not configured to parse root account events
   • BCloudTrail is not enabled for the root account
   • CThe root account API calls are not logged by CloudTrail
   • DThe trail is configured to log only read events, not write events
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is subject to PCI-DSS and must retain audit logs for at least one year, with the first three months immediately available for analysis. They also want to minimize storage costs. Which log storage strategy best meets these requirements?

   • AStore logs in hot storage for three months, then transition to cold storage for the remaining nine months
   • BStore logs in cold storage for one year
   • CStore all logs in hot storage for one year
   • DDelete logs after six months to reduce costs
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which component is typically used to send cloud logs to an external SIEM system?

   • AA network firewall
   • BA load balancer
   • CA log forwarder or agent
   • DA DNS server
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company's SIEM is being overwhelmed by the volume of logs from their cloud environment, causing delays in alert processing. They want to reduce the log volume without losing critical security visibility. Which strategy is most effective?

   • AFilter logs at the source to exclude verbose debug logs and known benign events, while forwarding all security-relevant logs.
   • BSend only summary statistics to the SIEM and store raw logs elsewhere.
   • CSample logs randomly to reduce the number of events sent to the SIEM.
   • DIncrease the SIEM's processing capacity by adding more compute resources.
   Reveal Solution Discussion Select an answer first