312-39 SOC For Cloud Environments — 25 Questions

Question 1

Your organization uses Google Cloud Platform. You need to identify which service provides VPC flow logs to monitor network traffic patterns between instances. Which service is used?

Accepted Answer

Cloud Logging. VPC Flow Logs are delivered to Cloud Logging, where they can be viewed, filtered, and exported. Cloud Logging is the service that stores and provides access to VPC flow log entries, making it the correct answer for where to monitor network traffic patterns between instances.

Answer

VPC Service Controls

Answer

Google Cloud Armor

Answer

Security Command Center

Question 2

You notice an unusual amount of outbound traffic from an Azure VM to a known malicious IP. What is the most effective way to block this traffic immediately at the network level?

Accepted Answer

Modify the Network Security Group (NSG) outbound rule. Modifying the Network Security Group (NSG) outbound rule is the most effective immediate network-level action to block traffic from an Azure VM to a known malicious IP. NSGs act as stateful firewalls at the subnet or NIC level, allowing or denying traffic based on rules. By adding a deny rule for outbound traffic to that IP, you can block the communication instantly without disrupting other services.

Answer

Update Azure Firewall rules

Answer

Delete the VM's public IP

Answer

Disable the Virtual Network

Question 3

A SOC analyst is investigating a potential data exfiltration from an Amazon S3 bucket. The analyst needs to identify which AWS services can provide relevant logs for this investigation. (Choose two.)

Accepted Answer

Amazon S3 server access logs. CloudTrail data events for S3 and S3 server access logs are the two services that provide object-level access records needed to investigate exfiltration. CloudTrail data events show API calls like GetObject, while S3 server access logs record detailed request information. AWS Config, GuardDuty findings, and Trusted Advisor do not provide the raw access logs required to trace data exfiltration.

Answer

AWS Trusted Advisor S3 bucket permissions check

Answer

Amazon GuardDuty S3 protection findings

Answer

AWS Config configuration history

Question 4

You are a SOC analyst for a company using Google Cloud Platform. You need to detect anomalous activity in your GCP environment. Which two of the following log sources should you prioritize to identify potential security incidents related to IAM and resource configuration changes? (Choose two.)

Accepted Answer

Cloud Audit Logs: Admin Activity. Admin Activity logs are always enabled and capture all API calls that modify resource configurations, including IAM changes. Access Transparency logs record access by Google personnel, which is vital for detecting insider threats or unauthorized access to your environment. Together, they provide visibility into both user-initiated and Google-initiated changes that could indicate a security incident. Other log types like Data Access or VPC Flow Logs focus on data reads or network traffic, not configuration changes.

Answer

VPC Flow Logs

Answer

Cloud Audit Logs: System Event

Answer

Cloud Audit Logs: Data Access

Question 5

A SOC analyst is reviewing Azure activity logs and notices a suspicious role assignment: a user was granted the Owner role on a subscription at 2:00 AM. The analyst needs to determine who performed this action and from which IP address. Which Azure log should the analyst query?

Accepted Answer

Azure Activity log. The Azure Activity log captures control plane operations, including role assignments, and provides details like the caller identity, operation name, and source IP address. This is the correct log to determine who granted the Owner role and from which IP. Microsoft Entra ID audit logs focus on Microsoft Entra ID objects, while sign-in logs only show authentication events. Azure Monitor activity log is essentially the same as the Activity log, but the standard term is 'Azure Activity log'.

Answer

Azure Monitor activity log

Answer

Azure AD sign-in logs

Answer

Azure Active Directory audit logs

Question 6

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers provides endpoint detection and response (EDR) capabilities through the integrated Defender for Endpoint agent, which captures process-level telemetry including command lines, parent-child process relationships, and file hashes. This is exactly what is needed to identify cryptomining binaries like XMRig and their execution chain on a compromised VM. Defender for Servers surfaces these events in the Microsoft 365 Defender portal for investigation.

Answer

Azure Advisor

Answer

Azure Network Watcher

Answer

Azure Resource Graph

Question 7

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

Accepted Answer

S3 Data Events. AWS GuardDuty uses S3 Data Events (CloudTrail S3 data events) as the data source to detect unusual S3 bucket access. When you enable S3 Protection in GuardDuty, it analyzes CloudTrail management and data events for S3, such as GetObject, PutObject, and DeleteObject, to identify suspicious activity like anomalous API calls or unusual user behavior. Without S3 Data Events enabled, GuardDuty cannot monitor object-level operations in S3 buckets.

Answer

VPC Flow Logs

Answer

EBS Snapshot logs

Answer

Route 53 Resolver query logs

Question 8

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

Accepted Answer

Security Command Center. Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. It surfaces misconfigurations, vulnerabilities, and threats — including IAM-based findings such as service accounts granted excessive permissions — through built-in detectors and Security Health Analytics.

Answer

Cloud Trace

Answer

Deployment Manager

Answer

Cloud Billing

Question 9

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

Accepted Answer

Microsoft Entra ID Sign-in logs. Microsoft Entra ID (formerly Azure AD) Sign-in logs capture authentication events including the geographic location (via IP geolocation), device details, and risk level (when Identity Protection is enabled). This is the correct place to investigate suspicious VM or user sign-in patterns.

Answer

Azure Policy Compliance dashboard

Answer

Azure Monitor Metrics

Answer

Azure Service Health

Question 10

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Accepted Answer

Modify Security Group to deny all traffic. The standard cloud-native isolation technique for a compromised EC2 instance is to modify its Security Group to deny all inbound and outbound traffic (or attach a pre-built 'quarantine' SG). This preserves the instance's memory, EBS volumes, and forensic state while cutting off C2 channels and lateral movement. It is non-destructive and reversible, unlike termination or volume deletion.

Answer

Remove the IAM Role

Answer

Disable the VPC

Answer

Terminate the instance

Question 11

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

Accepted Answer

Azure Policy. Azure Policy is the governance service that lets you define, assign, and enforce rules (policy definitions) over Azure resources, ensuring they remain compliant with organizational standards and preventing unauthorized or non-compliant changes. It evaluates resource properties against policy rules and can deny non-compliant deployments, audit existing resources, or auto-remediate drift. This directly matches the requirement to automatically enforce security settings and prevent unauthorized changes.

Answer

Azure Front Door

Answer

Azure Bastion

Answer

Azure Key Vault

Question 12

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records every API call made in an AWS account, including the identity of the caller, the action performed, the source IP address, and the timestamp. Querying CloudTrail event history or a CloudTrail Lake/Athena-backed trail lets you pinpoint the exact API call and originating IP for the unauthorized IAM role usage.

Answer

AWS Systems Manager

Answer

AWS Config

Answer

Amazon GuardDuty

Question 13

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

Accepted Answer

AWS Security Hub. AWS Security Hub is a centralized security and compliance service that aggregates findings from multiple AWS services and partner tools, providing a dashboard to identify misconfigurations and security issues across an organization. It runs automated checks against best practices and standards like CIS AWS Foundations and AWS Foundational Security Best Practices.

Answer

AWS Artifact

Answer

AWS Shield

Answer

AWS Trusted Advisor

Question 14

Which THREE of the following are benefits of using a SIEM integrated with Cloud native logs?

Accepted Answer

Centralized visibility across multiple cloud providers. Option A is correct because a SIEM integrated with cloud-native logs ingests log streams from AWS CloudTrail, Azure Activity Logs, and GCP Cloud Audit Logs into one platform, giving centralized visibility across multiple cloud providers. Option B is correct because the SIEM stores normalized events in a long-term index, enabling advanced threat hunting queries and analytics over historical data that native cloud consoles cannot retain or query at scale. Option D is correct because the SIEM's correlation engine joins events from different security layers (identity, network, workload, and control-plane logs) into a single detection timeline, surfacing multi-stage attacks that isolated tools would miss. Option C is not a SIEM function; guest OS kernel patching is performed by configuration-management or patch-management tools such as AWS Systems Manager Patch Manager or Azure Update Manager. Option E is not a SIEM function either; creating cloud accounts is an identity/provisioning task handled by services like AWS Organizations or Azure Management Groups, not by log analytics.

Answer

Automatic patching of guest OS kernels

Answer

Automated creation of new cloud accounts

Question 15

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

Accepted Answer

Cloud Storage Data Access logs. Cloud Storage Data Access logs record every read and write operation against objects in a bucket, including the identity, timestamp, and specific object names accessed. To identify which files were exfiltrated, the analyst must review these logs for GET/read operations during the alert window. This is the only option that captures per-object access detail.

Answer

Cloud Asset Inventory

Answer

Cloud Monitoring metrics

Answer

Cloud Load Balancing logs

Question 16

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

Accepted Answer

Enable global service events. Option A (Enable global service events) is correct because it ensures CloudTrail captures API activity from global services such as IAM, STS, and CloudFront, which are logged only in the us-east-1 region; without it, critical identity and access events would be missing from the audit trail. Option B (Enable Log File Integrity) is correct because it makes CloudTrail produce digest files with SHA-256 hashes and RSA digital signatures, allowing you to verify that log files have not been altered or deleted after delivery, which is essential for a tamper-evident security audit. Option C is wrong because disabling SNS notifications removes timely alerting on log delivery and is not a security best practice. Option D is wrong because limiting logs to one region would exclude API activity from other regions, weakening audit coverage. Option E is wrong because CloudTrail logs should be encrypted with AWS KMS (SSE-KMS) or SSE-S3, not a public key, which would be inappropriate for protecting log confidentiality.

Answer

Disable SNS notifications

Answer

Limit logs to one region

Answer

Encrypt logs with a public key

Question 17

Which TWO of the following are primary components of a cloud-native incident response plan?

Accepted Answer

Containment. Containment (D) is a primary component of a cloud-native incident response plan because it focuses on limiting the blast radius of a compromise—for example, by isolating affected workloads, revoking IAM credentials, or applying security group and network policy changes to stop lateral movement. Eradication (E) is equally essential, as it removes the root cause and residual artifacts of the incident, such as deleting malicious containers or images, patching exploited vulnerabilities, and rotating compromised keys, before returning to normal operations. Together, containment and eradication form the core response phases that follow detection and analysis in frameworks like NIST SP 800-61. Resource Provisioning (A) is an operational or infrastructure activity, not an incident response phase, and is not specific to handling security incidents. Budget Optimization (B) is a financial governance concern unrelated to incident response procedures. Hardware Refresh (C) is a lifecycle management task and is largely irrelevant in cloud-native environments where infrastructure is abstracted and ephemeral.

Answer

Resource Provisioning

Answer

Budget Optimization

Answer

Hardware Refresh

Question 18

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Accepted Answer

Modification of CloudTrail or logging configurations. Option A is correct because attackers routinely disable or tamper with CloudTrail trails, S3 access logging, or GuardDuty to erase their tracks, so any modification of logging configurations is a high-fidelity compromise indicator. Option D is correct because successful authentications from multiple geographically distant locations in a short window suggest credential theft or session hijacking, indicating account takeover. Option E is correct because creating an IAM user without an MFA device is a classic persistence technique used to establish a backdoor identity that survives password resets. Option B is not a reliable indicator, since free-tier usage is normal for many legitimate accounts and does not by itself signal compromise. Option C is not an indicator at all, as scheduled system reboots are routine maintenance activity rather than malicious behavior.

Answer

Increased usage of free-tier services

Answer

Standard scheduled system reboots

Question 19

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

Accepted Answer

Snapshot the persistent disk for forensics. Option B is correct because taking a snapshot of the persistent disk preserves volatile and non-volatile evidence (disk state, logs, files) for forensic analysis before any remediation destroys it, which is a standard incident-response step for a rogue VM. Option C is correct because restricting network ingress/egress rules (e.g., via VPC firewall rules or removing the VM's external IP) contains the threat by isolating the rogue VM and preventing lateral movement or data exfiltration while investigation proceeds. Option A is wrong because upgrading the OS image is a patching action that neither contains the rogue VM nor preserves evidence. Option D is wrong because increasing CPU quota is a performance change unrelated to incident response. Option E is wrong because deleting the VM immediately destroys forensic evidence and may tip off an attacker, so containment and snapshotting must come first.

Answer

Upgrade the VM's OS image

Answer

Increase the VM's CPU quota

Answer

Delete the VM immediately

Question 20

A SOC analyst in a Microsoft 365 E5 organization is investigating a phishing campaign that successfully compromised a user account. The analyst needs to determine whether the attacker created a mailbox rule that silently forwards incoming mail to an external address. Which Microsoft 365 security feature should the analyst query to retrieve this evidence?

Accepted Answer

Exchange Online Unified Audit Log. Mailbox forwarding rules created by attackers are Exchange configuration changes, and Exchange mailbox auditing writes them to the Unified Audit Log as operations like New-InboxRule with parameters including ForwardTo and the originating client IP. Querying that log is the authoritative way to confirm rule creation and forwarding destination.

Answer

Microsoft Defender for Cloud Apps activity log

Answer

Microsoft 365 Defender incidents queue

Answer

Azure AD sign-in logs