Cloud Logging and Security Monitoring CSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A multinational company must comply with GDPR, which restricts the transfer of personal data outside the EU. They are designing a cloud logging architecture and need to store logs that contain personal data. What is the most appropriate approach?

   • AAnonymize all personal data in logs before storage, then store them anywhere.
   • BEncrypt all logs and store them in any region, since encryption ensures compliance.
   • CStore logs in a cloud region located within the EU and ensure the logging service is configured to keep data in that region.
   • DStore logs in the company's on-premises data center in the US, as long as access is restricted.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A financial company is required to retain audit logs for seven years and must prove to auditors that the logs have not been tampered with. Which combination of measures best ensures log integrity while meeting the retention requirement?

   • AUse a log management service that supports cryptographic hash chaining and store the hash chain in a separate tamper-evident location
   • BCopy logs to a second region and enable cross-region replication
   • CStore logs in an append-only storage service and enable versioning
   • DEncrypt the logs with a customer-managed key and store the key in the same bucket
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst notices that a cloud storage bucket's access logs show a large number of GET requests from an IP address that is not associated with any known user or service. The analyst wants to determine if this is a legitimate data transfer or a potential data exfiltration. Which additional log source would be most helpful?

   • ANetwork flow logs from the virtual network
   • BAudit logs for the storage bucket
   • CCloud provider's billing logs
   • DApplication logs from the web server
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security analyst is investigating a potential data exfiltration incident. They notice that a large volume of data was transferred from an S3 bucket to an external IP address. Which log source would provide the most detailed information about the data that was transferred?

   • ACloudTrail logs
   • BS3 server access logs
   • CVPC Flow Logs
   • DAWS CloudWatch Logs
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   A security analyst notices a large number of failed login attempts from a single IP address followed by a successful login. Which log analysis technique would best identify this pattern?

   • ACorrelating authentication logs over time
   • BChecking the system uptime
   • CReviewing a single log entry
   • DAnalyzing network packet payloads
   Reveal Solution Discussion Select an answer first