Azure and AWS Logging Overview GCDA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations center (SOC) uses Azure Monitor for alerting on VM performance issues. The team now wants to add security-related alerts based on Windows Event Logs from the same VMs. What should they configure to collect these logs?

   • AAzure Network Watcher flow logs
   • BAzure Security Center (now Microsoft Defender for Cloud) only
   • CAzure Monitor agent with data collection rules
   • DAzure Activity Log diagnostic settings
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A security analyst wants to analyze network traffic metadata for all traffic to and from a specific EC2 instance, including accepted and rejected connection attempts. Which AWS service provides this data?

   • AVPC Flow Logs
   • BAWS Trusted Advisor
   • CAmazon CloudWatch Logs
   • DAWS CloudTrail
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst is familiar with AWS CloudTrail and needs to find the equivalent Azure service for auditing control-plane operations. Which Azure service should they use?

   • AAzure AD Sign-in Logs
   • BAzure Monitor Metrics
   • CAzure Policy
   • DAzure Activity Log
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst needs to create an alert when a user deletes a critical Azure resource group. The alert must be based on activity that occurs in the Azure control plane. Which Azure service should be used to create this alert?

   • AAzure Security Center with a regulatory compliance policy
   • BAzure AD Privileged Identity Management
   • CAzure Policy with a custom initiative
   • DAzure Monitor with an alert rule on the Activity Log
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst is building a unified detection pipeline that must ingest Azure Activity Log, AWS CloudTrail, and VPC Flow Logs into a single SIEM. The analyst wants to preserve the original raw log content for forensic investigations while also enabling fast, indexed queries on key fields. Which approach best meets this requirement?

   • AUse AWS CloudWatch Logs as the central repository and forward Azure Activity Log to it via a third-party agent.
   • BIngest all logs into a single Log Analytics workspace and rely on its native query language for both Azure and AWS data.
   • CExport logs to a central data lake for archival and use a SIEM with separate connectors for each cloud's logs for analysis.
   • DSend all logs to a central object storage bucket and run queries directly against the raw files.
   Reveal Solution Discussion Select an answer first