Secure Compute Deployment GCLD Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst needs to detect unauthorized access attempts to a cloud VM and ensure that all administrative actions are recorded. Which combination of monitoring and logging controls should be enabled?

   • AEnable cloud provider API call logging but do not enable OS-level auditing.
   • BConfigure a network firewall to log all blocked traffic and store logs locally on the VM.
   • CEnable VM-level audit logs for OS and application events, and stream them to a centralized log aggregation service.
   • DEnable only the cloud provider's default VM metrics, such as CPU and memory usage.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team wants to detect brute-force SSH attempts on a Linux VM and also ensure that all changes to the VM's security group rules are logged. Which monitoring and logging setup should be used?

   • AEnable cloud provider API logging only, which includes all actions.
   • BEnable only the VM's system metrics and rely on the provider's default logging.
   • CEnable SSH audit logging on the VM and enable cloud provider audit logs for security group changes.
   • DConfigure a network flow log for the VM's subnet and store it in the VM's local disk.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A system administrator is hardening a Windows VM that will host a database. The VM was created from a standard marketplace image. Which hardening action should be performed first?

   • ACreate a new administrator account and delete the default account.
   • BInstall additional database management tools and utilities.
   • CDisable the Windows Firewall to avoid interfering with database traffic.
   • DApply the latest operating system patches and updates.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is required to tag all cloud resources with a cost center and an environment (production, development). The security team also wants to ensure that only approved VM images are used. What is the most effective way to enforce these requirements?

   • ACreate a script that periodically scans for untagged VMs and terminates them.
   • BUse a monitoring tool to alert on untagged VMs but take no automated action.
   • CUse an organization policy that requires tags on new VMs and restricts VM creation to approved images.
   • DRely on developers to manually tag VMs and use any image they prefer.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security analyst is investigating a potential breach of a VM. The analyst has access to the cloud provider's audit logs and the VM's OS logs. The analyst notices that the VM's security group was modified to allow SSH from the internet just before the breach. What is the most important next step?

   • AIdentify which user or role made the security group change and correlate it with the OS logs.
   • BChange all passwords and access keys in the organization.
   • CImmediately revert the security group change and restore the VM from a backup.
   • DDelete the VM to prevent further damage.
   Reveal Solution Discussion Select an answer first