A company using Google Cloud wants to monitor for suspicious IAM permission changes and receive alerts when a user is granted the Owner role. They have enabled Cloud Audit Logs. What should they configure to get real-time alerts?

Create a log-based metric for the IAM permission change event and set up a Cloud Monitoring alert with a threshold of 1.

Use Cloud Asset Inventory to export IAM policy changes to BigQuery and run a daily query to find Owner role grants.

Enable Cloud DNS logging and create an alert for any DNS query containing 'Owner'.

Set up a Cloud Function that runs every hour to list IAM policies and compare them to a baseline.

A security analyst at a company using AWS needs to detect unauthorized API calls that create or modify IAM policies. The analyst wants a cloud-native solution that records the API activity and triggers an alert when specific IAM actions occur. Which combination of services should the analyst use?

Enable AWS Config and use its built-in rules to monitor IAM policy changes and send alerts via SES.

Enable VPC Flow Logs and analyze them with CloudWatch Logs Insights to detect IAM API calls.

Enable AWS CloudTrail for management events and create a CloudWatch Events rule that triggers an SNS notification for IAM actions.

Enable AWS Trusted Advisor and configure it to email alerts when IAM policies are modified.

A security team uses a cloud-native monitoring solution with a single alert rule that triggers on any failed login. The rule generates thousands of alerts per day, and the team has started ignoring them. They need to reduce noise while still detecting brute-force attacks. The team has limited time to manage the alert rules. What should they do?

Disable the alert and rely on manual log review

Increase the threshold to 100 failed logins in 5 minutes

Use a single alert rule with a threshold of 10 failed logins in 5 minutes and group alerts by source IP

Create a separate alert for each user account

EC-CouncilCloud Security Essentials

Domain 6Objective 3

Cloud-Native Monitoring Solutions CSE Practice Questions (Page 1)

Part of the Cloud Security Monitoring and Incident Response domain, which makes up ~13% of our current practice bank.

45questions here

9free pages

6concepts

Questions 1–5

1expert · hard
A company uses AWS and wants to monitor for potential credential theft by detecting when an access key is used from a new geographic location. They have CloudTrail enabled. Which cloud-native service can provide this detection without building custom logic?
Select an answer first
2foundation · easy
Which cloud-native monitoring service is primarily used to record API activity and provide an audit trail of user actions in AWS?
Select an answer first
3application · medium
A company using Google Cloud wants to monitor for suspicious IAM permission changes and receive alerts when a user is granted the Owner role. They have enabled Cloud Audit Logs. What should they configure to get real-time alerts?
Select an answer first
4application · medium
A security analyst at a company using AWS needs to detect unauthorized API calls that create or modify IAM policies. The analyst wants a cloud-native solution that records the API activity and triggers an alert when specific IAM actions occur. Which combination of services should the analyst use?
Select an answer first
5expert · hard
A security team uses a cloud-native monitoring solution with a single alert rule that triggers on any failed login. The rule generates thousands of alerts per day, and the team has started ignoring them. They need to reduce noise while still detecting brute-force attacks. The team has limited time to manage the alert rules. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.

Cloud-Native Monitoring Solutions CSE Practice Questions (Page 1)

Questions 1–5

A company uses AWS and wants to monitor for potential credential theft by detecting when an access key is used from a new geographic location. They have CloudTrail enabled. Which cloud-native service can provide this detection without building custom logic?

Which cloud-native monitoring service is primarily used to record API activity and provide an audit trail of user actions in AWS?

A company using Google Cloud wants to monitor for suspicious IAM permission changes and receive alerts when a user is granted the Owner role. They have enabled Cloud Audit Logs. What should they configure to get real-time alerts?

A security analyst at a company using AWS needs to detect unauthorized API calls that create or modify IAM policies. The analyst wants a cloud-native solution that records the API activity and triggers an alert when specific IAM actions occur. Which combination of services should the analyst use?

Keep studying — Cloud Security Monitoring and Incident Response