A security analyst is reviewing AWS CloudTrail logs and notices that an IAM user has been making API calls from two different IP addresses at the same time. What should the analyst do first?

Investigate the IP addresses and the API calls to determine if the user's credentials are compromised

Change the user's password and move on

Disable the IAM user immediately

Ignore the activity because it might be a VPN or proxy

A security analyst is investigating a potential brute-force attack on a cloud-based application. They have access to the application's authentication logs and the cloud provider's network flow logs. Which analysis would best confirm the attack?

Look at the application's performance metrics to see if CPU usage spiked during the attack.

Look for a high number of failed login attempts from a single IP address in the authentication logs, and then check the flow logs to see if that IP also had successful connections.

Review the authentication logs for any successful logins from unusual IP addresses.

Check the flow logs for any traffic to the application's IP address on port 443.

A company is required to maintain tamper-proof logs for compliance. They are using an on-premises SIEM and want to ensure that logs cannot be altered by an attacker who compromises the SIEM. Which approach provides the strongest protection?

Store logs in a cloud object storage service with Object Lock enabled

Forward logs to a separate, immutable cloud storage service in real-time and use a separate hash chain

Encrypt logs with a key stored in the SIEM

Use a write-once, read-many (WORM) storage appliance on-premises

A company wants to collect logs from its cloud-based virtual machines, containerized applications, and cloud storage buckets into a single centralized logging platform. Which approach would be the most comprehensive and efficient?

Enable only the cloud provider's default audit logging and rely on that for all sources.

Use a combination of cloud-native log collection agents for VMs and containers, and enable bucket-level logging for storage, then forward all to the central platform.

Use only network flow logs to infer all activity.

Install a single agent on the cloud storage service to collect logs from all sources.

EC-CouncilCloud Security Essentials

Domain 6Objective 1

Cloud Logging and Security Monitoring CSE Practice Questions (Page 6)

Part of the Cloud Security Monitoring and Incident Response domain, which makes up ~13% of our current practice bank.

48questions here

10free pages

8concepts

Questions 26–30

26application · medium
A security analyst is reviewing AWS CloudTrail logs and notices that an IAM user has been making API calls from two different IP addresses at the same time. What should the analyst do first?
Select an answer first
27application · medium
A security analyst is investigating a potential brute-force attack on a cloud-based application. They have access to the application's authentication logs and the cloud provider's network flow logs. Which analysis would best confirm the attack?
Select an answer first
28expert · hard
A company is required to maintain tamper-proof logs for compliance. They are using an on-premises SIEM and want to ensure that logs cannot be altered by an attacker who compromises the SIEM. Which approach provides the strongest protection?
Select an answer first
29application · medium
A company wants to collect logs from its cloud-based virtual machines, containerized applications, and cloud storage buckets into a single centralized logging platform. Which approach would be the most comprehensive and efficient?
Select an answer first
30foundation · easy
Which AWS service is specifically designed to record API activity in an AWS account for auditing and security monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.