312-39 SOC For Cloud Environments Practice Test 2 — 15 Questions

Question 1

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

Accepted Answer

Enable global service events. Option A (Enable global service events) is correct because it ensures CloudTrail captures API activity from global services such as IAM, STS, and CloudFront, which are logged only in the us-east-1 region; without it, critical identity and access events would be missing from the audit trail. Option B (Enable Log File Integrity) is correct because it makes CloudTrail produce digest files with SHA-256 hashes and RSA digital signatures, allowing you to verify that log files have not been altered or deleted after delivery, which is essential for a tamper-evident security audit. Option C is wrong because disabling SNS notifications removes timely alerting on log delivery and is not a security best practice. Option D is wrong because limiting logs to one region would exclude API activity from other regions, weakening audit coverage. Option E is wrong because CloudTrail logs should be encrypted with AWS KMS (SSE-KMS) or SSE-S3, not a public key, which would be inappropriate for protecting log confidentiality.

Answer

Disable SNS notifications

Answer

Limit logs to one region

Answer

Encrypt logs with a public key

Question 2

Which TWO of the following are primary components of a cloud-native incident response plan?

Accepted Answer

Containment. Containment (D) is a primary component of a cloud-native incident response plan because it focuses on limiting the blast radius of a compromise—for example, by isolating affected workloads, revoking IAM credentials, or applying security group and network policy changes to stop lateral movement. Eradication (E) is equally essential, as it removes the root cause and residual artifacts of the incident, such as deleting malicious containers or images, patching exploited vulnerabilities, and rotating compromised keys, before returning to normal operations. Together, containment and eradication form the core response phases that follow detection and analysis in frameworks like NIST SP 800-61. Resource Provisioning (A) is an operational or infrastructure activity, not an incident response phase, and is not specific to handling security incidents. Budget Optimization (B) is a financial governance concern unrelated to incident response procedures. Hardware Refresh (C) is a lifecycle management task and is largely irrelevant in cloud-native environments where infrastructure is abstracted and ephemeral.

Answer

Resource Provisioning

Answer

Budget Optimization

Answer

Hardware Refresh

Question 3

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Accepted Answer

Modification of CloudTrail or logging configurations. Option A is correct because attackers routinely disable or tamper with CloudTrail trails, S3 access logging, or GuardDuty to erase their tracks, so any modification of logging configurations is a high-fidelity compromise indicator. Option D is correct because successful authentications from multiple geographically distant locations in a short window suggest credential theft or session hijacking, indicating account takeover. Option E is correct because creating an IAM user without an MFA device is a classic persistence technique used to establish a backdoor identity that survives password resets. Option B is not a reliable indicator, since free-tier usage is normal for many legitimate accounts and does not by itself signal compromise. Option C is not an indicator at all, as scheduled system reboots are routine maintenance activity rather than malicious behavior.

Answer

Increased usage of free-tier services

Answer

Standard scheduled system reboots

Question 4

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

Accepted Answer

Snapshot the persistent disk for forensics. Option B is correct because taking a snapshot of the persistent disk preserves volatile and non-volatile evidence (disk state, logs, files) for forensic analysis before any remediation destroys it, which is a standard incident-response step for a rogue VM. Option C is correct because restricting network ingress/egress rules (e.g., via VPC firewall rules or removing the VM's external IP) contains the threat by isolating the rogue VM and preventing lateral movement or data exfiltration while investigation proceeds. Option A is wrong because upgrading the OS image is a patching action that neither contains the rogue VM nor preserves evidence. Option D is wrong because increasing CPU quota is a performance change unrelated to incident response. Option E is wrong because deleting the VM immediately destroys forensic evidence and may tip off an attacker, so containment and snapshotting must come first.

Answer

Upgrade the VM's OS image

Answer

Increase the VM's CPU quota

Answer

Delete the VM immediately

Question 5

A SOC analyst in a Microsoft 365 E5 organization is investigating a phishing campaign that successfully compromised a user account. The analyst needs to determine whether the attacker created a mailbox rule that silently forwards incoming mail to an external address. Which Microsoft 365 security feature should the analyst query to retrieve this evidence?

Accepted Answer

Exchange Online Unified Audit Log. Mailbox forwarding rules created by attackers are Exchange configuration changes, and Exchange mailbox auditing writes them to the Unified Audit Log as operations like New-InboxRule with parameters including ForwardTo and the originating client IP. Querying that log is the authoritative way to confirm rule creation and forwarding destination.

Answer

Microsoft Defender for Cloud Apps activity log

Answer

Microsoft 365 Defender incidents queue

Answer

Azure AD sign-in logs

Question 6

A SOC team uses AWS Security Hub to centralize findings from GuardDuty, Inspector, and Macie. The team wants to automatically route only high-severity findings to an incident response ticketing system while suppressing informational findings. Which AWS Security Hub capability should the team configure to accomplish this?

Accepted Answer

Security Hub automation rules. Security Hub automation rules apply criteria to incoming findings and can automatically update, suppress, or route them. Matching severity labels HIGH and CRITICAL while suppressing INFORMATIONAL findings lets the team forward only actionable high-severity findings to the ticketing system without manual triage.

Answer

Security Hub Insights

Answer

Security Hub custom actions

Answer

Security Hub finding aggregation

Question 7

A SOC analyst is investigating suspicious activity in a Google Cloud environment where a service account may have been compromised. The analyst needs to identify evidence of unauthorized use of that service account. (Choose two.)

Accepted Answer

Cloud Audit Logs Data Access entries showing API calls made by the service account to read or modify data. Cloud Audit Logs are the authoritative source for service account activity. Admin Activity entries reveal IAM and configuration changes, while Data Access entries reveal reads and writes on data resources. Together they show both privilege changes and data operations performed by the compromised identity, which is the evidence needed to confirm unauthorized use.

Answer

Security Command Center asset inventory listing IAM policies attached to the service account

Answer

VPC Flow Logs showing the source IP addresses of connections to the service account's resources

Answer

Cloud Monitoring uptime check results for services associated with the service account

Question 8

A SOC analyst is reviewing Microsoft 365 audit logs after a user reported a suspicious email. The analyst wants to determine whether the email was delivered to the user's mailbox and whether the user interacted with a malicious URL in the message. Which Microsoft 365 tool should the analyst use to trace message delivery and inspect URL click events?

Accepted Answer

Microsoft Defender for Office 365 Threat Explorer. Threat Explorer in Microsoft Defender for Office 365 is the correct tool because it combines email delivery status with user interaction data such as URL clicks. The analyst can filter by recipient, sender, or URL to confirm if the message reached the mailbox and whether the user clicked the malicious link. The other tools either lack click telemetry or focus on different data sets.

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft 365 Defender Advanced Hunting with DeviceEvents

Answer

Exchange admin center message trace

Question 9

A SOC analyst is investigating a suspected compromise of an AWS Lambda function. The analyst needs to determine what code was executed and which IAM role the function assumed during the suspicious activity. Which AWS service should the analyst use to review the function's configuration and execution role?

Accepted Answer

AWS Lambda console or GetFunction API. The Lambda console and GetFunction API are correct because they expose the function's configuration, including the execution role and the code package. An analyst can retrieve the role ARN and download the code to review what was executed. CloudTrail, CloudWatch Logs, and X-Ray provide runtime or API-level data but not the function's configured role or code.

Answer

AWS X-Ray

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 10

You are a SOC analyst at a company that uses Microsoft 365. You receive an alert that a user's mailbox is being accessed from an unusual location. You need to review the mailbox audit logs to determine which operations were performed and by whom. Which Microsoft 365 tool should you use to search these logs?

Accepted Answer

Microsoft 365 compliance center audit log search. The Microsoft 365 compliance center audit log search queries the unified audit log, which captures mailbox operations such as MailItemsAccessed, SendAs, and SendOnBehalf. This is the authoritative source for investigating suspicious mailbox access and determining which operations were performed and by whom. Other tools like Defender for Cloud Apps or Microsoft Entra ID sign-in logs provide complementary data but lack the granular mailbox audit events needed here.

Answer

Azure Active Directory sign-in logs

Answer

Exchange admin center mail flow rules

Answer

Microsoft Defender for Cloud Apps activity log

Question 11

A SOC analyst notices that an AWS Lambda function's execution role was modified to include the AdministratorAccess managed policy. The change was made outside of any approved change window. The analyst needs to determine who made the modification and from which IP address. Which AWS service should the analyst query to retrieve this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the authoritative source for API activity in an AWS account. It logs every API call, including IAM policy attachments, and captures the caller's identity, source IP, and timestamp. By querying CloudTrail event history for the AttachRolePolicy action on the Lambda execution role, the analyst can pinpoint the unauthorized change and its origin, enabling incident response.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 12

A SOC team is reviewing Azure activity logs and notices a series of role assignments being created for a service principal. The assignments grant Owner permissions at the subscription scope. The team needs to identify the exact operation name and the caller's IP address to determine if this is malicious. Which Azure log should they query?

Accepted Answer

Azure Activity Log. The Azure Activity Log is the correct source because it logs all control plane operations at the subscription level, including role assignment creations. It includes the operation name, caller identity, and caller IP address. By filtering for role assignment write operations, the SOC team can identify the exact operation and source IP, enabling them to determine if the service principal's actions are unauthorized.

Answer

Azure Monitor Metrics

Answer

Azure Network Watcher Flow Logs

Answer

Azure AD Sign-in Logs

Question 13

A security analyst is investigating suspicious activity in a Google Cloud environment. The analyst suspects that a service account key was used from an unauthorized location to access Cloud Storage buckets. The analyst needs to identify the source IP address and the specific API method called. Which GCP service should the analyst use?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs are the correct choice because they capture all API activity in GCP, including the caller's identity, source IP address, and the specific API method. For a suspected compromised service account key, the analyst can filter logs by the service account email and review the caller's IP and method calls to Cloud Storage, enabling detection of unauthorized access.

Answer

VPC Flow Logs

Answer

Cloud Asset Inventory

Answer

Cloud Monitoring

Question 14

A SOC analyst is investigating a security incident in an AWS environment. The analyst needs to determine which AWS API calls were made by a specific IAM user over the past week. Which AWS service should the analyst use to retrieve this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that logs all API activity in an AWS account, capturing details such as the caller identity, timestamp, source IP, and request parameters. By querying CloudTrail event history or delivering logs to S3, a SOC analyst can filter by IAM user and time range to see exactly which API calls were made. Other services like GuardDuty or Security Hub provide derived findings but not the raw audit trail needed for this investigation.

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

AWS Config

Question 15

A SOC analyst is monitoring an Azure environment and receives an alert about a suspicious sign-in from an unfamiliar location. The analyst wants to review the sign-in logs to see the applied conditional access policies and the risk level of the sign-in. Which Azure AD log should the analyst use?

Accepted Answer

Azure AD sign-in logs. Microsoft Entra ID sign-in logs are the correct source because they contain detailed information about each sign-in, including applied conditional access policies and risk levels. They allow the analyst to see why the sign-in was deemed suspicious. Audit logs, Activity logs, and Azure Monitor logs do not directly provide this information without additional configuration.

Answer

Azure Activity log

Answer

Azure Monitor logs

Answer

Azure AD audit logs