Cloud-Native Monitoring Solutions CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company operates in a regulated industry and must retain security logs for at least one year. They use a cloud-native monitoring solution that stores logs for 30 days by default. They need to maintain the ability to query logs older than 30 days for incident investigations. The company has a limited budget. What should they do?

   • AUse a third-party SIEM that stores logs for one year
   • BIncrease the monitoring tool's retention period to one year
   • CStore logs only in the monitoring tool for 30 days and then delete them
   • DExport logs to a low-cost storage service and load them into the monitoring tool when needed
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization wants to automate incident response for a known malware signature. When the monitoring tool detects the signature in a VM, it should automatically quarantine the VM and block the associated network traffic. However, the security team is concerned about false positives disrupting business operations. What should they do?

   • AOnly send an email notification and take no automated action
   • BQuarantine the VM but do not block network traffic
   • CUse a manual approval step before executing the quarantine action
   • DAutomatically quarantine the VM and block traffic for all detections
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is migrating to the cloud and needs to ensure that their security monitoring solution can handle a high volume of logs from many services. They also need to support real-time alerting and long-term storage for compliance. The budget is limited. What should they consider?

   • AUse a third-party tool that only stores logs for 30 days
   • BUse a single-tier storage for all logs to simplify management
   • CUse a hot tier for real-time alerting and a cold tier for long-term storage
   • DStore all logs in cold storage and query them in real time
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary benefit of aggregating logs from multiple cloud services into a central monitoring platform?

   • AIt automatically blocks malicious IP addresses
   • BIt eliminates the need for any additional security tools
   • CIt reduces the total amount of log data that must be stored
   • DIt enables correlation of events across services to identify complex attack patterns
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An Azure administrator wants to be alerted when a user signs in from a new location and then performs a privileged role activation. They have Azure AD Premium P2 and Azure Monitor. What is the most efficient cloud-native way to create this alert?

   • ACreate a log alert in Azure Monitor that queries sign-in logs for new locations and role activation events, and triggers an action group.
   • BConfigure Azure AD Privileged Identity Management (PIM) to email when a role is activated, and separately monitor sign-in logs manually.
   • CSet up Azure Sentinel (Microsoft Sentinel) analytics rules to detect the sequence, but this requires additional licensing and setup.
   • DUse Azure AD Identity Protection to detect risky sign-ins and configure its built-in alerts for role activation.
   Reveal Solution Discussion Select an answer first