Cloud-Native Monitoring Solutions CSE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   During an incident, the security team needs to automatically collect relevant logs from multiple cloud services, enrich them with threat intelligence, and create a ticket in their ticketing system. They want to minimize manual effort. What should they implement?

   • AA manual runbook that instructs analysts to gather logs
   • BA scheduled job that exports all logs to cold storage
   • CA notification email sent to the team when an alert fires
   • DA playbook that triggers on alerts and uses automation to collect and enrich logs
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company uses AWS and Azure for different workloads. They want a unified security monitoring view across both clouds, including log aggregation, alerting, and incident investigation. The team is small and prefers a managed service. What should they use?

   • AAWS CloudTrail for AWS and Azure Monitor for Azure, with no integration
   • BA third-party SIEM that ingests logs from both clouds
   • CUse only Azure Sentinel and ignore AWS
   • DUse only AWS Security Hub and ignore Azure
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company uses multiple cloud services and wants to correlate login events from their identity provider with resource access logs from their cloud provider. They need a centralized platform to query these logs together and create alerts for unusual access patterns. What should they use?

   • AA log aggregation tool that ingests logs from multiple sources and supports querying
   • BA network monitoring tool that only captures traffic
   • CA separate database for each log source
   • DA spreadsheet that combines exported logs
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An organization wants to automate the initial response to a suspected compromised VM. When the monitoring tool detects a suspicious process, it should isolate the VM and notify the incident response team. What should they implement?

   • AAn email notification to the security team only
   • BA manual process where analysts log in and isolate the VM
   • CA scheduled job that checks for suspicious processes every hour
   • DA runbook that triggers on the alert and uses automation to isolate the VM
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security team using Google Cloud wants to be notified immediately when a VM instance is created with a public IP address, as this may indicate unauthorized resource provisioning. They have already enabled Cloud Audit Logs. What should they configure to meet this requirement?

   • AEnable VPC Flow Logs and create a Cloud Monitoring alert for any flow log entry that contains a public IP.
   • BSet up a Cloud Scheduler job to run a Cloud Function every hour that checks the Compute Engine API for new instances with public IPs.
   • CUse Cloud Asset Inventory to export resource changes to BigQuery and set up a scheduled query to email the team daily.
   • DCreate a Cloud Monitoring alerting policy that uses a log-based metric to count compute.instances.insert events with a public IP and set a threshold of 1.
   Reveal Solution Discussion Select an answer first