Cloud Logging Fundamentals GCLD Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is implementing centralized logging for a multi-account cloud environment. They need to ensure that logs from all accounts are available for security monitoring while minimizing administrative overhead. Which approach is most effective?

   • AEnable logging only in the account that contains the most sensitive data
   • BStore logs in each account's local storage and manually aggregate them monthly
   • CUse a centralized logging account that receives log exports from all other accounts
   • DConfigure logging independently in each account and access them separately
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following best describes the primary purpose of cloud logging in the context of security monitoring and incident response?

   • ATo replace the need for dedicated security monitoring tools by providing real-time alerts for every security event.
   • BTo automatically block all malicious traffic and prevent security incidents from occurring.
   • CTo provide a chronological record of events and activities that can be used to detect, investigate, and respond to security incidents.
   • DTo store data in a way that guarantees compliance with all regulatory requirements without additional configuration.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing logs after a suspected data breach. The analyst needs to determine whether any sensitive data was accessed from outside the corporate network. Which log types should be correlated to make this determination?

   • AApplication logs and database logs
   • BAuthentication logs and network logs
   • CFile integrity logs and system logs
   • DDNS logs and firewall logs
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst is trying to determine if an attacker accessed a specific file in a cloud storage bucket. The bucket has data access logs enabled, but the logs only show the operation type (GET, PUT) and the object name. What additional field would be most useful to identify the attacker?

   • AThe user identity or access key used for the request
   • BThe encryption status of the object
   • CThe size of the object accessed
   • DThe storage class of the object
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization is using a cloud-based database and wants to detect unauthorized queries. Which log source should be enabled?

   • ADatabase audit logs that record query activity
   • BConfiguration change logs
   • CNetwork flow logs
   • DAuthentication logs
   Reveal Solution Discussion Select an answer first