Cloud-Native Monitoring Solutions CSE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An AWS customer has a requirement to alert on any S3 bucket policy change that makes a bucket public. They want to receive alerts within 5 minutes of the change. They have CloudTrail enabled and S3 data events logging enabled. Which solution provides the fastest and most reliable alerting?

   • ACreate a CloudWatch Events rule that matches the PutBucketPolicy API call and triggers an SNS topic, with the SNS topic sending an email.
   • BEnable S3 server access logs and use Athena to query for PutBucketPolicy events every 10 minutes.
   • CUse AWS Config to detect public S3 buckets and set up a CloudWatch alarm on the config rule compliance.
   • DUse Amazon GuardDuty to detect public S3 buckets and send alerts via CloudWatch Events.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An Azure security operations center (SOC) wants to automate the initial triage of low-severity security alerts from Microsoft Defender for Cloud. They want to automatically close alerts that are determined to be false positives based on a known list of safe IP addresses. They also want to escalate true positives to a human analyst. Which cloud-native solution should they use?

   • AConfigure Defender for Cloud's built-in suppression rules to automatically dismiss alerts from safe IPs.
   • BUse Microsoft Sentinel with a playbook that checks the alert's IP address against a watchlist and either closes the alert or assigns it to an analyst.
   • CUse Azure Monitor action groups to automatically close alerts from Defender for Cloud based on a static list of IPs.
   • DUse Azure Logic Apps directly with a trigger on Defender for Cloud alerts, but this requires custom code to close alerts.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst is investigating a suspected data exfiltration from an AWS EC2 instance. They need to determine if large amounts of data were transferred to an external IP. Which cloud-native data source should they analyze?

   • AAWS Config timeline
   • BAWS CloudTrail logs
   • CVPC Flow Logs
   • DAmazon GuardDuty findings
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company uses Google Cloud and wants to detect when a user creates a new IAM role and then assigns it to a service account. They need to set up an alert that triggers only when both actions occur in sequence. Which service should they use to create this custom alert?

   • ACloud Monitoring
   • BCloud Operations
   • CCloud Logging
   • DCloud IAM
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   How do cloud-native monitoring solutions typically integrate with incident response workflows?

   • ABy isolating the cloud account from the internet permanently
   • BBy automatically creating a ticket in a ticketing system when an alert is triggered
   • CBy deleting all logs related to the incident to protect privacy
   • DBy directly applying security patches to affected resources
   Reveal Solution Discussion Select an answer first