Network Security Monitoring in the Cloud GCLD Practice Questions (Page 9)

Questions 41–43

1. 41application · medium

   A company uses a multi-cloud environment with workloads in AWS and Azure. The security team wants a centralized view of network traffic across both clouds and the ability to correlate anomalies. Which approach best meets this requirement?

   • AUse AWS VPC Flow Logs and Azure Network Watcher independently, reviewing each console separately.
   • BEnable Azure Monitor and AWS CloudWatch and create dashboards in each.
   • CDeploy a virtual appliance in each cloud and have them send data to a shared syslog server.
   • DExport flow logs from both clouds to a third-party SIEM platform that supports multi-cloud data sources.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A cloud security team wants to detect anomalous outbound traffic from a Kubernetes cluster. They have enabled flow logs for the VPC and are sending them to a SIEM. Which configuration would best enable the detection of a compromised pod that is beaconing to an external IP?

   • AEnable VPC Flow Logs and use a SIEM query to identify repeated outbound connections to the same destination IP at regular intervals.
   • BConfigure the Kubernetes dashboard to display network traffic statistics.
   • CDeploy a network intrusion detection system (IDS) inline in the pod network to inspect all east-west traffic.
   • DCreate a SIEM rule that alerts on any outbound connection to a public IP address.
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A company uses GCP and has VPC Flow Logs enabled. They are experiencing a high volume of false positives from their anomaly detection system, which alerts on any new external IP connection. The security team wants to reduce false positives while still detecting real threats. Which approach is most effective?

   • AAlert on all new external IPs but suppress alerts for IPs in a known-good list.
   • BBaseline normal traffic patterns over a period and create alerts only for deviations from the baseline, such as unusual volume or new IPs that are not in an allowlist.
   • CDisable alerts for external IPs and only alert on internal-to-internal traffic.
   • DIncrease the alert threshold to require multiple connections to the same external IP before alerting.
   Reveal Solution Discussion Select an answer first