Cloud Monitoring Fundamentals GCTD Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security architect is evaluating a cloud monitoring solution that must detect threats in real-time while also meeting compliance requirements for log retention. The solution generates a high volume of alerts, many of which are false positives. What is the best approach to improve the effectiveness of the monitoring solution?

   • ADisable real-time alerts and rely on daily log reviews to reduce alert fatigue.
   • BIncrease the log retention period to ensure all data is available for compliance audits.
   • CRoute all alerts to a separate email address for the security team to review at the end of the week.
   • DImplement alert tuning and correlation rules to reduce false positives while maintaining real-time detection.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is using a cloud-based CRM system and wants to monitor for potential data breaches. The security team needs to detect when large volumes of data are exported from the CRM. Which monitoring approach would be most effective?

   • AMonitor network traffic to the CRM provider's data center.
   • BMonitor CPU and memory usage of the CRM servers.
   • CMonitor API call logs for unusual export operations and set thresholds for data volume.
   • DMonitor user login activity and alert on failed login attempts.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security operations center (SOC) is evaluating tools to improve threat detection in their cloud environment. They need a solution that provides a unified view of security events across multiple cloud providers. Which capability is most important for this requirement?

   • AThe ability to ingest and normalize logs from various cloud services into a central platform.
   • BThe ability to generate compliance reports for regulatory standards.
   • CThe ability to automatically remediate misconfigurations in each cloud environment.
   • DThe ability to create separate dashboards for each cloud provider's security alerts.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is evaluating monitoring solutions for a new cloud environment. They have a requirement to detect threats in real time, but they also need to retain logs for at least one year for compliance. Which approach best balances real-time detection and long-term log retention?

   • AStore all logs in the SIEM for one year to ensure both detection and retention.
   • BEnable real-time alerts but do not retain logs beyond 30 days.
   • CUse a SIEM for real-time detection and archive raw logs to cold storage for retention.
   • DUse only cold storage for logs and run batch analysis periodically.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing the monitoring setup for a cloud environment and notices that the monitoring system is generating a large number of false positives. The analyst wants to improve the signal-to-noise ratio. Which action should they take?

   • ARefine detection rules to reduce false positives while maintaining detection coverage.
   • BIncrease the frequency of monitoring checks to generate more data.
   • CDisable all alerts that have generated false positives in the past.
   • DAdd more monitoring tools to cross-check alerts.
   Reveal Solution Discussion Select an answer first