Cloud Monitoring Fundamentals GCTD Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security engineer is setting up monitoring for a new AWS environment that hosts a public-facing web application. The engineer needs to detect anomalous API calls that might indicate credential theft or insider misuse. Which monitoring approach best satisfies this requirement?

   • AEnable AWS CloudTrail and AWS Config, and use Amazon GuardDuty to analyze CloudTrail events for suspicious API activity.
   • BEnable AWS CloudTrail for all regions and configure a metric filter for specific API error codes, then alert on the metric.
   • CUse AWS Trusted Advisor to review IAM access key rotations and alert on keys older than 90 days.
   • DEnable VPC Flow Logs and analyze them for unusual outbound traffic patterns from the web servers.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security engineer is designing a monitoring solution for a cloud environment that uses both containers and virtual machines. The solution must provide visibility into threats across both technologies. What is the most important consideration?

   • AEnsuring that monitoring covers both the host level and the container/application level.
   • BMonitoring only the orchestration platform, such as Kubernetes, for security events.
   • CFocusing only on container-level monitoring, as VMs are less likely to be targeted.
   • DUsing separate monitoring tools for containers and VMs without integration.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is setting up a monitoring solution for a multi-cloud environment. The primary goal is to detect unauthorized access attempts across all cloud services. Which approach best aligns with the core purpose of cloud monitoring for threat detection?

   • AEnable native cloud provider security alerts and review them monthly for any critical findings.
   • BConfigure a dashboard that displays the number of failed login attempts across all cloud accounts.
   • CDeploy a network intrusion detection system in each cloud VPC to monitor traffic for known attack signatures.
   • DCollect and analyze logs from all cloud services, correlating events to identify patterns indicative of unauthorized access.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is configuring monitoring for a cloud application. The goal is to detect potential data exfiltration by monitoring outbound network traffic. Which monitoring data source is most directly relevant?

   • AVirtual network flow logs that record source and destination IPs and ports.
   • BCloud billing reports that show cost spikes by service.
   • CIdentity and access management logs that record user login events.
   • DApplication performance monitoring metrics such as CPU and memory utilization.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is reviewing cloud monitoring logs and notices that a user account is attempting to access resources outside of normal business hours. What is the most appropriate next step in the context of threat detection?

   • AIgnore the activity because off-hours access is common and rarely indicates a threat.
   • BInvestigate the activity further by correlating with other logs and user context before deciding if it is a threat.
   • CReport the activity to the user's manager without further analysis.
   • DImmediately disable the user account to prevent potential unauthorized access.
   Reveal Solution Discussion Select an answer first