During an incident, an Azure security analyst needs to quickly identify all resources that were modified in the last hour and correlate that with authentication events. The analyst wants to use a single cloud-native tool to query both resource change logs and sign-in logs. Which service should they use?

Azure Security Center (Defender for Cloud)

Azure Monitor Logs (Log Analytics)

A security analyst is investigating a potential breach in Google Cloud. They need to trace a specific user's actions across multiple services (Compute Engine, Cloud Storage, and IAM) during a 15-minute window. They have Cloud Audit Logs enabled. What is the most efficient way to perform this investigation?

Export all audit logs to BigQuery and run a SQL query to find the user's actions.

Check each service's individual logs separately, such as Compute Engine logs and Cloud Storage logs.

Use Cloud Asset Inventory to view the user's IAM permissions and infer their actions.

Use Cloud Logging to query audit logs with a filter for the user's email and the time range, and review the results.

An Azure administrator needs to ensure that all security logs from virtual machines, including Windows Event Logs and Linux Syslog, are collected in a Log Analytics workspace. They also want to use the same workspace to query these logs for signs of compromise. Which configuration should they use?

Install the Azure Monitor Agent on each VM and configure data collection rules to send Event Logs and Syslog to the workspace.

Use the legacy Log Analytics agent and configure it manually on each VM, but this is being deprecated.

Enable VM Insights, which automatically collects all logs from VMs without additional configuration.

Use Azure Policy to deploy the Azure Monitor Agent, but this does not configure data collection rules.

An Azure security team is designing an incident response workflow. They need to automatically create a ticket in their ITSM tool when a high-severity security alert is generated by Microsoft Defender for Cloud. They also want to include relevant resource context in the ticket. Which cloud-native integration should they use?

Configure a webhook in Defender for Cloud to call the ITSM API directly, and manually include resource details in the webhook payload.

Use Microsoft Sentinel (Azure Sentinel) with a playbook that runs on alert creation and creates an ITSM ticket with the alert details.

Use an Azure Monitor action group with an ITSM action that triggers on Defender for Cloud alerts.

Set up an Azure Automation runbook that polls for new alerts and creates tickets, but this requires custom scripting.

EC-CouncilCloud Security Essentials

Domain 6Objective 3

Cloud-Native Monitoring Solutions CSE Practice Questions (Page 3)

Part of the Cloud Security Monitoring and Incident Response domain, which makes up ~13% of our current practice bank.

45questions here

9free pages

6concepts

Questions 11–15

11application · medium
During an incident, an Azure security analyst needs to quickly identify all resources that were modified in the last hour and correlate that with authentication events. The analyst wants to use a single cloud-native tool to query both resource change logs and sign-in logs. Which service should they use?
Select an answer first
12expert · hard
A security analyst is investigating a potential breach in Google Cloud. They need to trace a specific user's actions across multiple services (Compute Engine, Cloud Storage, and IAM) during a 15-minute window. They have Cloud Audit Logs enabled. What is the most efficient way to perform this investigation?
Select an answer first
13expert · hard
An Azure administrator needs to ensure that all security logs from virtual machines, including Windows Event Logs and Linux Syslog, are collected in a Log Analytics workspace. They also want to use the same workspace to query these logs for signs of compromise. Which configuration should they use?
Select an answer first
14expert · hard
An Azure security team is designing an incident response workflow. They need to automatically create a ticket in their ITSM tool when a high-severity security alert is generated by Microsoft Defender for Cloud. They also want to include relevant resource context in the ticket. Which cloud-native integration should they use?
Select an answer first
15foundation · easy
Which Azure service provides a unified monitoring platform for collecting metrics, logs, and alerts across Azure resources?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.

Cloud-Native Monitoring Solutions CSE Practice Questions (Page 3)

Questions 11–15

An Azure administrator needs to ensure that all security logs from virtual machines, including Windows Event Logs and Linux Syslog, are collected in a Log Analytics workspace. They also want to use the same workspace to query these logs for signs of compromise. Which configuration should they use?

Which Azure service provides a unified monitoring platform for collecting metrics, logs, and alerts across Azure resources?

Keep studying — Cloud Security Monitoring and Incident Response