1.5 Identify and Describe Cost Optimization Methods (e.g., Scan Cadence, Duplicate Audit Logs) CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team uses a cloud-based scanner that charges per scan. The team has a set of workloads that are scanned daily. After a review, the team finds that the workloads have not changed in the past three months and are not critical to the business. The team wants to reduce costs. What should the team do?

   • AIncrease the scan depth to get more detailed results from each scan.
   • BContinue scanning the workloads daily to ensure no new vulnerabilities are missed.
   • CChange the scan cadence for these workloads to a weekly or monthly schedule.
   • DDisable scanning for these workloads entirely.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations team is reviewing its cloud audit log pipeline. The team notices that the same API call events are being ingested from multiple sources: the cloud provider's activity log, the organization's SIEM, and a separate security analytics tool. The storage costs for the log repository have increased significantly over the past quarter. The team wants to reduce storage costs while preserving the ability to investigate security incidents. What should the team do first?

   • AImmediately increase the log retention period to ensure no data is lost.
   • BDisable all audit logging for the cloud provider's activity log to reduce the data volume.
   • CIdentify which sources are producing duplicate events and configure the pipeline to ingest from only one authoritative source.
   • DMove all audit logs to a cheaper storage tier without changing the ingestion pipeline.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which activity best exemplifies cost optimization in a cloud security context?

   • AReviewing and adjusting security controls to match actual risk
   • BPurchasing the most expensive security tool available
   • CStoring all audit logs indefinitely
   • DRunning continuous vulnerability scans on all resources
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company's security team is investigating a potential security incident. The team needs to correlate audit logs from the cloud provider, the operating system, and the application layer. The team discovers that the same user activity is logged by all three sources, creating a large volume of duplicate data. The SIEM storage costs are high, and the team wants to reduce them. However, the team is concerned that deduplication might remove critical context needed for the investigation. What is the best approach?

   • ADeduplicate events based on a common event ID, but retain the original source-specific fields in the deduplicated record.
   • BDisable deduplication and keep all logs from all sources to ensure no context is lost.
   • CReduce the retention period for all logs to 30 days to lower storage costs.
   • DMove all logs to a cold storage tier to reduce costs, even though access is slower.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is managing a cloud environment with a mix of production and development workloads. The team uses a security platform that charges based on the number of workloads monitored. The development workloads are only used during the day, while the production workloads run 24/7. The team wants to reduce costs. What is the best approach?

   • ADisable monitoring for all development workloads to reduce costs.
   • BMonitor the production workloads 24/7 and the development workloads only during business hours.
   • CMonitor the development workloads 24/7 and the production workloads only during business hours.
   • DMonitor all workloads 24/7 to ensure maximum security coverage.
   Reveal Solution Discussion Select an answer first