Cloud Logging and Security Monitoring CSE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is analyzing logs from a web application and notices a pattern: a single IP address makes a request to /login.php, then immediately requests /admin.php, and then downloads a large file. The team wants to determine if this is a brute-force attack, a privilege escalation attempt, or a normal user session. Which log analysis technique would be most effective?

   • ACheck the network flow logs to see if the IP address is on a known malicious list.
   • BLook at the size of the downloaded file to determine if it is sensitive.
   • CCount the number of requests from the IP address over the last hour.
   • DCorrelate the web server access logs with authentication logs to see if the login succeeded and whether the user had admin privileges.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A financial company must retain audit logs for seven years to meet PCI-DSS requirements. They also need to prove to auditors that logs have not been altered. The company uses a cloud provider that offers object storage with object lock (WORM) and also has an on-premises SIEM. Which approach best meets both the retention and integrity requirements?

   • AStore logs only in the on-premises SIEM and rely on the SIEM's internal database to prevent tampering.
   • BWrite logs to cloud object storage without object lock, but enable server-side encryption to ensure integrity.
   • CStream logs to the on-premises SIEM and also write them to cloud object storage with object lock enabled for the seven-year retention period.
   • DUse a cloud log aggregation service that retains logs for 90 days and export them to a cold storage archive without WORM.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company has a SIEM that receives logs from multiple cloud providers. They notice that some logs are missing during peak hours due to network congestion. They want to ensure no logs are lost. Which approach is the most reliable?

   • AReduce the number of logs sent by filtering out less critical events.
   • BSend logs directly from the source to the SIEM without any intermediary.
   • CUse a cloud-native log export mechanism that retries failed deliveries and provides a dead-letter queue for undeliverable logs.
   • DIncrease the SIEM's ingestion rate limit to handle more logs per second.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a primary benefit of integrating cloud logs with a SIEM system?

   • AEliminating the need for any other security controls
   • BReplacing the cloud provider's native monitoring tools
   • CCentralized monitoring and alerting across multiple sources
   • DAutomatically patching all vulnerabilities
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is required by GDPR to ensure that logs containing personal data are protected from unauthorized access and alteration. They currently store logs in a cloud logging service with standard access controls. What additional measure should they implement to strengthen log integrity?

   • AEnable encryption at rest and in transit for the log data.
   • BUse a separate, immutable storage bucket with write-once-read-many (WORM) settings for log archival.
   • CStore logs only in memory to avoid disk tampering.
   • DGrant all security team members full write access to the logs for easier management.
   Reveal Solution Discussion Select an answer first