312-39 SOC For Cloud Environments — 10 Questions

Question 1

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Cloud (specifically the Endpoint protection or integrated EDR) provides process-level visibility and alerts for suspicious activity on VMs.

Answer

Azure Advisor

Answer

Azure Network Watcher

Answer

Azure Resource Graph

Question 2

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

Accepted Answer

S3 Data Events. GuardDuty requires S3 Data Events (via CloudTrail) to monitor access patterns at the object level within S3 buckets.

Answer

VPC Flow Logs

Answer

EBS Snapshot logs

Answer

Route 53 Resolver query logs

Question 3

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

Accepted Answer

Security Command Center. Security Command Center (SCC) provides a dashboard of findings, including misconfigurations and overly permissive IAM roles.

Answer

Cloud Trace

Answer

Deployment Manager

Answer

Cloud Billing

Question 4

Your organization uses Google Cloud Platform. You need to identify which service provides VPC flow logs to monitor network traffic patterns between instances. Which service is used?

Accepted Answer

Cloud Logging. VPC Flow Logs in GCP are integrated directly into Cloud Logging to track network connections.

Answer

VPC Service Controls

Answer

Google Cloud Armor

Answer

Security Command Center

Question 5

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

Accepted Answer

Microsoft Entra ID Sign-in logs. Azure AD (Microsoft Entra ID) Sign-in logs provide detailed information about user authentication attempts, including risk flags and location data.

Answer

Azure Policy Compliance dashboard

Answer

Azure Monitor Metrics

Answer

Azure Service Health

Question 6

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Accepted Answer

Modify Security Group to deny all traffic. Modifying the Security Group associated with the instance is the standard practice to isolate it while maintaining the state for forensics.

Answer

Remove the IAM Role

Answer

Disable the VPC

Answer

Terminate the instance

Question 7

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

Accepted Answer

Azure Policy. Azure Policy allows you to define rules that enforce compliance and prevent non-compliant resource configurations.

Answer

Azure Front Door

Answer

Azure Bastion

Answer

Azure Key Vault

Question 8

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

Accepted Answer

AWS CloudTrail. AWS CloudTrail provides comprehensive logs for all API calls made within an AWS account, including the identity that made the call and the source IP address.

Answer

AWS Systems Manager

Answer

AWS Config

Answer

Amazon GuardDuty

Question 9

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates findings from various AWS security services like GuardDuty, Inspector, and Config into a single view.

Answer

AWS Artifact

Answer

AWS Shield

Answer

AWS Trusted Advisor

Question 10

Which THREE of the following are benefits of using a SIEM integrated with Cloud native logs?

Accepted Answer

Centralized visibility across multiple cloud providers. SIEM integration allows for cross-platform correlation, long-term log retention, and advanced threat hunting that is difficult to perform in native cloud consoles alone.

Answer

Automatic patching of guest OS kernels

Answer

Automated creation of new cloud accounts