Cloud-Native Monitoring Solutions CSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team in an Azure environment needs to collect security logs from Azure AD, Azure Platform (Activity Log), and virtual machines into a single repository for incident investigation. They also want to use the same repository to run queries across all data. What should they implement?

   • AAn Azure Storage account to store all logs and use Azure Storage Explorer to search them.
   • BA single Log Analytics workspace with diagnostic settings sending all logs to that workspace.
   • CSeparate Log Analytics workspaces for each source and use Azure Data Explorer to query them together.
   • DAzure Event Hubs to stream all logs to a custom SIEM, but this requires additional infrastructure.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company uses Azure and wants to centralize security logs from multiple subscriptions into a single workspace for cross-subscription analysis during incident response. They also need to retain the logs for 90 days. Which Azure Monitor feature should they use?

   • AEnable Azure Monitor for VMs and use the Azure Monitor agent to forward logs to a central event hub.
   • BUse Azure Activity Log export to a storage account and query it with Azure Storage Analytics.
   • CCreate a Log Analytics workspace and add all subscriptions as data sources to send their logs to that workspace.
   • DConfigure Azure Sentinel (Microsoft Sentinel) to collect logs from each subscription separately and query them individually.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a common notification channel used by cloud-native monitoring solutions to alert security teams?

   • ANFS mount
   • BDNS query
   • CDHCP lease
   • DEmail
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a primary purpose of cloud-native monitoring solutions in the context of security incident response?

   • ATo automatically patch all cloud resources and eliminate the need for manual security updates
   • BTo enforce identity and access management policies across all cloud services
   • CTo provide real-time visibility into cloud resources and workloads, enabling detection and investigation of security incidents
   • DTo replace the need for security information and event management (SIEM) systems entirely
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is evaluating cloud-native monitoring solutions for a multi-cloud environment (AWS and Azure). They need to collect security logs from both clouds into a single dashboard for real-time alerting and incident response. They have a limited budget and want to minimize the number of tools. Which approach is most effective?

   • AUse Google Cloud Operations Suite to monitor both AWS and Azure, but this requires migrating all workloads to Google Cloud.
   • BUse Azure Monitor as the central hub, and configure AWS CloudTrail and CloudWatch to export logs to Azure Monitor via Event Hubs.
   • CUse a third-party SIEM like Splunk or IBM QRadar to aggregate logs from both clouds, but this may exceed the budget.
   • DUse AWS Security Hub and Azure Defender for Cloud separately, and manually correlate alerts in a custom dashboard.
   Reveal Solution Discussion Select an answer first