Azure and AWS Logging Overview GCDA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company runs a hybrid environment with Azure VMs and AWS EC2 instances. The security team needs to detect unauthorized configuration changes across both clouds and correlate them with user identity. Which combination of logs should be collected to meet this need?

   • AAzure Network Watcher logs and AWS VPC Flow Logs
   • BAzure Activity Log and AWS CloudTrail
   • CAzure Diagnostic Settings and AWS CloudWatch Logs
   • DAzure Monitor metrics and AWS CloudWatch metrics
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   A company is migrating from on-premises to Azure and AWS. They need to ensure that security logs are available for incident response within 15 minutes of an event. Which approach meets this requirement?

   • AUse real-time streaming connectors to send Azure Activity Log and AWS CloudTrail to a SIEM.
   • BUse email alerts from each cloud provider to notify the security team.
   • CStore logs in each cloud's native log service and query them manually during an incident.
   • DExport logs to S3 and Azure Blob Storage, then run nightly batch jobs to ingest into a SIEM.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security architect is designing a logging strategy for a new application that will run in both Azure and AWS. The application will generate custom security events that need to be correlated across both clouds. The team wants to use a single query interface and minimize the number of tools. Which approach best meets these requirements?

   • AUse Microsoft Sentinel as the central SIEM, ingesting custom logs from both Azure and AWS via connectors.
   • BUse Azure Log Analytics for Azure logs and CloudWatch Logs Insights for AWS logs, and manually correlate results.
   • CUse Azure Monitor Metrics to store custom events from both clouds.
   • DUse AWS Athena to query logs stored in S3 from both clouds.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is investigating a possible data breach involving an EC2 instance. They have CloudTrail logs showing API calls, but they need to determine if data was actually exfiltrated over the network. They also need to see if any security group rules were changed to allow outbound traffic. Which combination of AWS logs should they analyze?

   • ACloudTrail and VPC Flow Logs
   • BCloudTrail and CloudWatch Logs
   • CVPC Flow Logs and AWS Config
   • DCloudWatch Logs and AWS Config
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A security architect is designing a multi-cloud logging solution for a financial institution. The institution requires that all cloud audit logs be retained for 7 years and be immutable to satisfy regulatory requirements. They also need to run complex queries across Azure and AWS logs for threat hunting. The budget is limited, so they want to minimize storage costs while maintaining query performance. Which solution best meets these requirements?

   • AEnable S3 Object Lock in AWS and Azure Blob Storage immutability, and use a SIEM that queries both sources.
   • BUse AWS S3 for Azure logs and Azure Blob for AWS logs, then query each separately.
   • CStore all logs in AWS CloudWatch Logs with a 7-year retention policy and use CloudWatch Logs Insights for queries.
   • DStore all logs in Azure Log Analytics with a 7-year retention and use KQL for queries.
   Reveal Solution Discussion Select an answer first