Continuous Security Monitoring Strategies CSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is implementing continuous monitoring and is concerned about the high cost of storing and processing large volumes of log data. They want to maintain effective monitoring while controlling costs. What is the best approach?

   • AUse a third-party SIEM that charges per GB ingested, and ingest all logs.
   • BCollect only critical logs and discard all others to reduce storage costs.
   • CStore logs for only 30 days and then delete them permanently.
   • DStore all logs in a low-cost storage tier and use a log analytics service to query only when needed.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which best practice helps reduce false positives in continuous monitoring?

   • ATuning alert thresholds based on observed baseline behavior
   • BIgnoring all low-severity alerts
   • CDisabling all alerts to avoid noise
   • DIncreasing the number of alerts generated
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company runs a multi-account AWS environment. The security team needs a single, centralized view of API activity across all accounts, including who made changes to IAM policies and S3 bucket permissions. They also want to trigger a notification when a root user logs in. What should they configure?

   • AEnable VPC Flow Logs in each account and analyze them with Amazon Athena for IAM changes.
   • BEnable AWS Config in each account and use its compliance rules to detect root login and IAM changes.
   • CEnable AWS CloudTrail in each account and aggregate trails into a central S3 bucket, then create a CloudWatch Events rule for root login.
   • DUse AWS Trusted Advisor to monitor IAM policy changes and root login across all accounts.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company must provide compliance reports to auditors showing that security monitoring is effective. They have a large volume of logs but limited resources to analyze them. Which approach best demonstrates continuous monitoring effectiveness?

   • AProvide auditors with raw log files and let them analyze the data.
   • BAutomate the generation of reports that summarize key security metrics, such as number of alerts, time to respond, and unresolved incidents.
   • CRely on the cloud provider's compliance certifications as evidence.
   • DCreate a one-time report at the end of the year.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is configuring anomaly detection for a cloud environment that experiences significant seasonal variations in traffic, such as a retail website with peak shopping periods. They want to minimize false positives while ensuring that genuine anomalies are detected. What is the most effective approach?

   • AManually adjust thresholds each month based on expected traffic.
   • BUse a machine learning-based anomaly detection service that automatically learns seasonal patterns and adjusts baselines.
   • CSet a static threshold based on the highest observed traffic during the year.
   • DUse a simple average of the last 30 days as the baseline and alert on any deviation.
   Reveal Solution Discussion Select an answer first