312-39 SOC For Cloud Environments Practice Test 1 — 15 Questions

Question 1

Your organization uses Google Cloud Platform. You need to identify which service provides VPC flow logs to monitor network traffic patterns between instances. Which service is used?

Accepted Answer

Cloud Logging. VPC Flow Logs are delivered to Cloud Logging, where they can be viewed, filtered, and exported. Cloud Logging is the service that stores and provides access to VPC flow log entries, making it the correct answer for where to monitor network traffic patterns between instances.

Answer

VPC Service Controls

Answer

Google Cloud Armor

Answer

Security Command Center

Question 2

You notice an unusual amount of outbound traffic from an Azure VM to a known malicious IP. What is the most effective way to block this traffic immediately at the network level?

Accepted Answer

Modify the Network Security Group (NSG) outbound rule. Modifying the Network Security Group (NSG) outbound rule is the most effective immediate network-level action to block traffic from an Azure VM to a known malicious IP. NSGs act as stateful firewalls at the subnet or NIC level, allowing or denying traffic based on rules. By adding a deny rule for outbound traffic to that IP, you can block the communication instantly without disrupting other services.

Answer

Update Azure Firewall rules

Answer

Delete the VM's public IP

Answer

Disable the Virtual Network

Question 3

A SOC analyst is investigating a potential data exfiltration from an Amazon S3 bucket. The analyst needs to identify which AWS services can provide relevant logs for this investigation. (Choose two.)

Accepted Answer

Amazon S3 server access logs. CloudTrail data events for S3 and S3 server access logs are the two services that provide object-level access records needed to investigate exfiltration. CloudTrail data events show API calls like GetObject, while S3 server access logs record detailed request information. AWS Config, GuardDuty findings, and Trusted Advisor do not provide the raw access logs required to trace data exfiltration.

Answer

AWS Trusted Advisor S3 bucket permissions check

Answer

Amazon GuardDuty S3 protection findings

Answer

AWS Config configuration history

Question 4

You are a SOC analyst for a company using Google Cloud Platform. You need to detect anomalous activity in your GCP environment. Which two of the following log sources should you prioritize to identify potential security incidents related to IAM and resource configuration changes? (Choose two.)

Accepted Answer

Cloud Audit Logs: Admin Activity. Admin Activity logs are always enabled and capture all API calls that modify resource configurations, including IAM changes. Access Transparency logs record access by Google personnel, which is vital for detecting insider threats or unauthorized access to your environment. Together, they provide visibility into both user-initiated and Google-initiated changes that could indicate a security incident. Other log types like Data Access or VPC Flow Logs focus on data reads or network traffic, not configuration changes.

Answer

VPC Flow Logs

Answer

Cloud Audit Logs: System Event

Answer

Cloud Audit Logs: Data Access

Question 5

A SOC analyst is reviewing Azure activity logs and notices a suspicious role assignment: a user was granted the Owner role on a subscription at 2:00 AM. The analyst needs to determine who performed this action and from which IP address. Which Azure log should the analyst query?

Accepted Answer

Azure Activity log. The Azure Activity log captures control plane operations, including role assignments, and provides details like the caller identity, operation name, and source IP address. This is the correct log to determine who granted the Owner role and from which IP. Microsoft Entra ID audit logs focus on Microsoft Entra ID objects, while sign-in logs only show authentication events. Azure Monitor activity log is essentially the same as the Activity log, but the standard term is 'Azure Activity log'.

Answer

Azure Monitor activity log

Answer

Azure AD sign-in logs

Answer

Azure Active Directory audit logs

Question 6

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers provides endpoint detection and response (EDR) capabilities through the integrated Defender for Endpoint agent, which captures process-level telemetry including command lines, parent-child process relationships, and file hashes. This is exactly what is needed to identify cryptomining binaries like XMRig and their execution chain on a compromised VM. Defender for Servers surfaces these events in the Microsoft 365 Defender portal for investigation.

Answer

Azure Advisor

Answer

Azure Network Watcher

Answer

Azure Resource Graph

Question 7

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

Accepted Answer

S3 Data Events. AWS GuardDuty uses S3 Data Events (CloudTrail S3 data events) as the data source to detect unusual S3 bucket access. When you enable S3 Protection in GuardDuty, it analyzes CloudTrail management and data events for S3, such as GetObject, PutObject, and DeleteObject, to identify suspicious activity like anomalous API calls or unusual user behavior. Without S3 Data Events enabled, GuardDuty cannot monitor object-level operations in S3 buckets.

Answer

VPC Flow Logs

Answer

EBS Snapshot logs

Answer

Route 53 Resolver query logs

Question 8

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

Accepted Answer

Security Command Center. Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. It surfaces misconfigurations, vulnerabilities, and threats — including IAM-based findings such as service accounts granted excessive permissions — through built-in detectors and Security Health Analytics.

Answer

Cloud Trace

Answer

Deployment Manager

Answer

Cloud Billing

Question 9

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

Accepted Answer

Microsoft Entra ID Sign-in logs. Microsoft Entra ID (formerly Azure AD) Sign-in logs capture authentication events including the geographic location (via IP geolocation), device details, and risk level (when Identity Protection is enabled). This is the correct place to investigate suspicious VM or user sign-in patterns.

Answer

Azure Policy Compliance dashboard

Answer

Azure Monitor Metrics

Answer

Azure Service Health

Question 10

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Accepted Answer

Modify Security Group to deny all traffic. The standard cloud-native isolation technique for a compromised EC2 instance is to modify its Security Group to deny all inbound and outbound traffic (or attach a pre-built 'quarantine' SG). This preserves the instance's memory, EBS volumes, and forensic state while cutting off C2 channels and lateral movement. It is non-destructive and reversible, unlike termination or volume deletion.

Answer

Remove the IAM Role

Answer

Disable the VPC

Answer

Terminate the instance

Question 11

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

Accepted Answer

Azure Policy. Azure Policy is the governance service that lets you define, assign, and enforce rules (policy definitions) over Azure resources, ensuring they remain compliant with organizational standards and preventing unauthorized or non-compliant changes. It evaluates resource properties against policy rules and can deny non-compliant deployments, audit existing resources, or auto-remediate drift. This directly matches the requirement to automatically enforce security settings and prevent unauthorized changes.

Answer

Azure Front Door

Answer

Azure Bastion

Answer

Azure Key Vault

Question 12

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records every API call made in an AWS account, including the identity of the caller, the action performed, the source IP address, and the timestamp. Querying CloudTrail event history or a CloudTrail Lake/Athena-backed trail lets you pinpoint the exact API call and originating IP for the unauthorized IAM role usage.

Answer

AWS Systems Manager

Answer

AWS Config

Answer

Amazon GuardDuty

Question 13

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

Accepted Answer

AWS Security Hub. AWS Security Hub is a centralized security and compliance service that aggregates findings from multiple AWS services and partner tools, providing a dashboard to identify misconfigurations and security issues across an organization. It runs automated checks against best practices and standards like CIS AWS Foundations and AWS Foundational Security Best Practices.

Answer

AWS Artifact

Answer

AWS Shield

Answer

AWS Trusted Advisor

Question 14

Which THREE of the following are benefits of using a SIEM integrated with Cloud native logs?

Accepted Answer

Centralized visibility across multiple cloud providers. Option A is correct because a SIEM integrated with cloud-native logs ingests log streams from AWS CloudTrail, Azure Activity Logs, and GCP Cloud Audit Logs into one platform, giving centralized visibility across multiple cloud providers. Option B is correct because the SIEM stores normalized events in a long-term index, enabling advanced threat hunting queries and analytics over historical data that native cloud consoles cannot retain or query at scale. Option D is correct because the SIEM's correlation engine joins events from different security layers (identity, network, workload, and control-plane logs) into a single detection timeline, surfacing multi-stage attacks that isolated tools would miss. Option C is not a SIEM function; guest OS kernel patching is performed by configuration-management or patch-management tools such as AWS Systems Manager Patch Manager or Azure Update Manager. Option E is not a SIEM function either; creating cloud accounts is an identity/provisioning task handled by services like AWS Organizations or Azure Management Groups, not by log analytics.

Answer

Automatic patching of guest OS kernels

Answer

Automated creation of new cloud accounts

Question 15

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

Accepted Answer

Cloud Storage Data Access logs. Cloud Storage Data Access logs record every read and write operation against objects in a bucket, including the identity, timestamp, and specific object names accessed. To identify which files were exfiltrated, the analyst must review these logs for GET/read operations during the alert window. This is the only option that captures per-object access detail.

Answer

Cloud Asset Inventory

Answer

Cloud Monitoring metrics

Answer

Cloud Load Balancing logs