SOC For Cloud Environments

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

Which THREE of the following are benefits of using a SIEM integrated with Cloud native logs?

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

Which TWO of the following are primary components of a cloud-native incident response plan?

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

A SOC analyst in a Microsoft 365 E5 organization is investigating a phishing campaign that successfully compromised a user account. The analyst needs to determine whether the attacker created a mailbox rule that silently forwards incoming mail to an external address. Which Microsoft 365 security feature should the analyst query to retrieve this evidence?

A SOC team uses AWS Security Hub to centralize findings from GuardDuty, Inspector, and Macie. The team wants to automatically route only high-severity findings to an incident response ticketing system while suppressing informational findings. Which AWS Security Hub capability should the team configure to accomplish this?

A SOC analyst is investigating suspicious activity in a Google Cloud environment where a service account may have been compromised. The analyst needs to identify evidence of unauthorized use of that service account. (Choose two.)

A SOC analyst is reviewing Microsoft 365 audit logs after a user reported a suspicious email. The analyst wants to determine whether the email was delivered to the user's mailbox and whether the user interacted with a malicious URL in the message. Which Microsoft 365 tool should the analyst use to trace message delivery and inspect URL click events?

A SOC analyst is investigating a suspected compromise of an AWS Lambda function. The analyst needs to determine what code was executed and which IAM role the function assumed during the suspicious activity. Which AWS service should the analyst use to review the function's configuration and execution role?

You are a SOC analyst at a company that uses Microsoft 365. You receive an alert that a user's mailbox is being accessed from an unusual location. You need to review the mailbox audit logs to determine which operations were performed and by whom. Which Microsoft 365 tool should you use to search these logs?

A SOC analyst notices that an AWS Lambda function's execution role was modified to include the AdministratorAccess managed policy. The change was made outside of any approved change window. The analyst needs to determine who made the modification and from which IP address. Which AWS service should the analyst query to retrieve this information?

A SOC team is reviewing Azure activity logs and notices a series of role assignments being created for a service principal. The assignments grant Owner permissions at the subscription scope. The team needs to identify the exact operation name and the caller's IP address to determine if this is malicious. Which Azure log should they query?

A security analyst is investigating suspicious activity in a Google Cloud environment. The analyst suspects that a service account key was used from an unauthorized location to access Cloud Storage buckets. The analyst needs to identify the source IP address and the specific API method called. Which GCP service should the analyst use?

A SOC analyst is investigating a security incident in an AWS environment. The analyst needs to determine which AWS API calls were made by a specific IAM user over the past week. Which AWS service should the analyst use to retrieve this information?

A SOC analyst is monitoring an Azure environment and receives an alert about a suspicious sign-in from an unfamiliar location. The analyst wants to review the sign-in logs to see the applied conditional access policies and the risk level of the sign-in. Which Azure AD log should the analyst use?

A SOC team is building detection rules for cloud infrastructure. They want to identify potentially malicious activities in AWS that could indicate an account compromise. Which TWO of the following AWS API calls should be monitored as high-priority indicators of compromise? (Choose two.)

A SOC analyst is reviewing logs from a cloud environment and needs to determine if an Amazon S3 bucket was made publicly accessible. The analyst wants to identify the specific API call that changed the bucket's access control list (ACL). Which AWS service should the analyst check?

A SOC analyst is investigating a potential compromise in an AWS environment. The analyst suspects that an attacker used a set of temporary credentials obtained from an EC2 instance metadata service. Which AWS service should the analyst review to determine which IAM role was assumed and what actions were taken with those credentials?

A SOC analyst in an AWS environment receives an alert that an EC2 instance is making unusual outbound DNS queries to a domain associated with command-and-control activity. The analyst needs to identify the full chain of API calls that led to the instance's current state, including any IAM role assumptions or network modifications. Which AWS service should the analyst use to retrieve this information?

A SOC analyst is investigating a security incident in Microsoft Azure where an attacker may have used a compromised service principal to access resources. The analyst needs to review sign-in activity for the service principal and identify any conditional access policy evaluations. Which Azure log should the analyst query to obtain this information?

A SOC analyst is monitoring a Google Cloud environment and receives an alert about a potentially compromised service account. The analyst needs to investigate the extent of the compromise by examining audit logs. Which TWO log types should the analyst review to identify actions taken by the service account and any configuration changes made to it? (Choose two.)

A SOC analyst is reviewing security alerts in an AWS environment and notices a finding that an S3 bucket has been configured with public read access. The analyst needs to identify the IAM principal that made the bucket public. Which AWS service should the analyst check to find the identity that performed the PutBucketAcl or PutBucketPolicy action?