Continuous Security Monitoring Strategies CSE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security analyst is investigating a suspected data exfiltration from a cloud storage bucket. They need to determine whether data was accessed by an unauthorized user. Which combination of monitoring data sources would provide the most complete evidence?

   • ACloud provider API logs (e.g., CloudTrail) for bucket access, plus authentication logs for the user identity.
   • BNetwork flow logs only, showing traffic to the bucket's IP address.
   • CPerformance metrics for the storage service.
   • DCloud provider's billing reports.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing cloud activity logs and notices that a user who typically logs in from the US is now logging in from a foreign country at unusual hours. The analyst wants to determine if this is a potential security incident. What is the most appropriate next step?

   • ACompare the login event against the user's baseline behavior and investigate further if it deviates significantly.
   • BIgnore the event because the user may be traveling.
   • CImmediately disable the user's account and escalate to management.
   • DCheck the user's recent password change history to see if it was recently changed.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC receives an alert from their continuous monitoring system about a potential data exfiltration from a cloud storage bucket. The alert includes the source IP, the user account, and the files accessed. According to incident response best practices, what should the SOC do first?

   • ADelete the cloud storage bucket to prevent further access.
   • BImmediately block the source IP address at the firewall.
   • CTriage the alert to confirm it is a true positive and assess the severity and impact.
   • DNotify the data owner and ask them to verify the access.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company uses a multi-cloud environment (AWS and Azure). They want a unified continuous monitoring solution that can correlate security events across both platforms. Which approach is most appropriate?

   • AUse only Azure Monitor because it can monitor AWS resources through connectors.
   • BDeploy a third-party SIEM that ingests logs from both AWS and Azure and provides a single dashboard and correlation engine.
   • CUse AWS CloudTrail and Azure Monitor separately and manually compare alerts.
   • DUse AWS Security Hub as the single tool for both clouds.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is moving from periodic security reviews to continuous monitoring. They want to ensure that the transition improves their security posture. Which change is most indicative of a successful transition?

   • AThe security team generates more reports than before.
   • BThe company has more monitoring tools deployed.
   • CSecurity incidents are detected and responded to in near real-time rather than after the next scheduled review.
   • DThe security team meets monthly to review logs.
   Reveal Solution Discussion Select an answer first