Which log analysis approach is most effective for detecting an anomaly such as a user accessing resources at unusual hours?

Searching for a specific error code

Establishing a baseline of normal user behavior

Reviewing logs only during business hours

Counting the total number of logs

A security analyst notices that a cloud storage bucket has been accessed from an IP address that is not on the approved list. The analyst wants to determine whether the access was successful and what data was retrieved. Which combination of log sources should the analyst examine first?

Application logs and network flow logs

Cloud provider API audit logs and storage access logs

Operating system logs from the storage service

EC-CouncilCloud Security Essentials

Domain 6Objective 1

Cloud Logging and Security Monitoring CSE Practice Questions (Page 9)

Part of the Cloud Security Monitoring and Incident Response domain, which makes up ~13% of our current practice bank.

48questions here

10free pages

8concepts

Questions 41–45

41expert · hard
A company is using AWS and has enabled VPC Flow Logs, CloudTrail, and GuardDuty. They want to centralize these logs for analysis. Which service should they use to aggregate and query these logs?
Select an answer first
42foundation · easy
Which log analysis approach is most effective for detecting an anomaly such as a user accessing resources at unusual hours?
Select an answer first
43foundation · easy
Which type of cloud log is most useful for detecting a brute-force attack against a web application hosted in the cloud?
Select an answer first
44application · medium
A security analyst notices that a cloud storage bucket has been accessed from an IP address that is not on the approved list. The analyst wants to determine whether the access was successful and what data was retrieved. Which combination of log sources should the analyst examine first?
Select an answer first
45application · medium
A DevOps team is troubleshooting a security incident where an application running on a virtual machine made unexpected outbound network connections. Which log source would provide the most direct evidence of these connections?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.

Cloud Logging and Security Monitoring CSE Practice Questions (Page 9)

Questions 41–45

A company is using AWS and has enabled VPC Flow Logs, CloudTrail, and GuardDuty. They want to centralize these logs for analysis. Which service should they use to aggregate and query these logs?

Which log analysis approach is most effective for detecting an anomaly such as a user accessing resources at unusual hours?

Which type of cloud log is most useful for detecting a brute-force attack against a web application hosted in the cloud?

A security analyst notices that a cloud storage bucket has been accessed from an IP address that is not on the approved list. The analyst wants to determine whether the access was successful and what data was retrieved. Which combination of log sources should the analyst examine first?

A DevOps team is troubleshooting a security incident where an application running on a virtual machine made unexpected outbound network connections. Which log source would provide the most direct evidence of these connections?

Keep studying — Cloud Security Monitoring and Incident Response