Cloud Logging Fundamentals GCLD Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team wants to detect brute-force attacks against their cloud-based application. Which log source should be analyzed to identify repeated failed login attempts?

   • ADNS query logs
   • BApplication logs that record login events
   • CNetwork flow logs
   • DConfiguration change logs
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is investigating a suspicious API call that created a new user account. They have the cloud audit logs, but the logs do not include the source IP address of the caller. What is the most likely reason for this gap?

   • AThe logs were truncated due to size limits
   • BThe audit log configuration does not include the source IP field
   • CThe API call was made from a cloud service, not a user
   • DThe audit log service does not record source IP addresses
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is designing a logging strategy for a new cloud environment. They need to detect unauthorized access attempts and track changes to security group rules. Which two log types must be enabled to meet both requirements?

   • ANetwork flow logs and DNS logs
   • BAPI activity logs and network flow logs
   • CGuest OS logs and application logs
   • DAuthentication logs and configuration change logs
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A cloud administrator needs to ensure that all administrative actions on cloud resources are recorded for compliance auditing. Which log type should be enabled?

   • ACloud audit logs that capture API calls
   • BNetwork flow logs
   • CGuest OS system logs
   • DApplication performance logs
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has a centralized logging system that ingests logs from multiple cloud accounts. The security team wants to ensure that logs cannot be tampered with by an attacker who compromises a cloud account. Which approach provides the strongest protection?

   • AStreaming logs to a separate, immutable storage location with write-once-read-many (WORM) protection
   • BEnabling verbose logging for all services
   • CEncrypting logs with a customer-managed key
   • DStoring logs in the same account but with restricted IAM permissions
   Reveal Solution Discussion Select an answer first