Data and Storage Monitoring GCTD Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is reviewing cloud storage access logs and notices that a user downloaded a large number of files from a sensitive bucket at 3:00 AM. The user's normal activity occurs during business hours. What should the analyst do first to investigate this potential anomaly?

   • AIncrease the bucket's logging level to capture more detailed access information
   • BImmediately delete the user's access keys and revoke all permissions
   • CCorrelate the access logs with the user's authentication events and check if the user's credentials were used from an unusual location
   • DCheck the bucket's encryption status to ensure the downloaded files were encrypted
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security operations center (SOC) uses a ticketing system to manage incidents. The SOC wants to automatically create a ticket when a storage bucket is made public or when an unusual data access pattern is detected. Which approach should the SOC take?

   • AConfigure alerts on storage security and access anomalies to trigger a webhook that creates a ticket in the ticketing system
   • BSet up a dashboard that shows storage alerts and hope that analysts notice them
   • CHave the storage administrator manually review logs each day and create tickets for any issues
   • DSend all storage logs to a centralized log management tool and rely on analysts to search them
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of setting up alerts for storage-related anomalies?

   • ATo ensure backups are encrypted
   • BTo automatically increase storage capacity
   • CTo replace the need for manual log review
   • DTo notify security teams of potential issues in real time
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A cloud operations team wants to build a dashboard that shows the health of all storage services, including object storage, block storage, and file storage. The dashboard should display performance metrics, availability, and capacity utilization. Which data sources should the team aggregate to build this dashboard?

   • AApplication logs from the servers using the storage
   • BCloud provider metrics, logs, and events from each storage service
   • CNetwork traffic logs from the virtual network
   • DOnly the billing reports for each storage service
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company's backup system uses object storage with versioning enabled. The security team wants to detect if an attacker deletes backup versions to prevent recovery. The team has enabled logging for the storage service. Which monitoring approach would best detect this type of attack?

   • ASet up a lifecycle rule to prevent deletion of backup objects
   • BMonitor storage capacity and alert if it decreases by more than 10%
   • CMonitor deletion events for backup objects and alert if a large number of versions are deleted in a short time
   • DMonitor access logs for read requests to the backup bucket
   Reveal Solution Discussion Select an answer first