312-39 SOC For Cloud Environments — Timed 10 Questions

Question 1

Your organization uses Google Cloud Platform. You need to identify which service provides VPC flow logs to monitor network traffic patterns between instances. Which service is used?

Accepted Answer

Cloud Logging. VPC Flow Logs are delivered to Cloud Logging, where they can be viewed, filtered, and exported. Cloud Logging is the service that stores and provides access to VPC flow log entries, making it the correct answer for where to monitor network traffic patterns between instances.

Answer

VPC Service Controls

Answer

Google Cloud Armor

Answer

Security Command Center

Question 2

You notice an unusual amount of outbound traffic from an Azure VM to a known malicious IP. What is the most effective way to block this traffic immediately at the network level?

Accepted Answer

Modify the Network Security Group (NSG) outbound rule. Modifying the Network Security Group (NSG) outbound rule is the most effective immediate network-level action to block traffic from an Azure VM to a known malicious IP. NSGs act as stateful firewalls at the subnet or NIC level, allowing or denying traffic based on rules. By adding a deny rule for outbound traffic to that IP, you can block the communication instantly without disrupting other services.

Answer

Update Azure Firewall rules

Answer

Delete the VM's public IP

Answer

Disable the Virtual Network

Question 3

A SOC analyst is investigating a potential data exfiltration from an Amazon S3 bucket. The analyst needs to identify which AWS services can provide relevant logs for this investigation. (Choose two.)

Accepted Answer

Amazon S3 server access logs. CloudTrail data events for S3 and S3 server access logs are the two services that provide object-level access records needed to investigate exfiltration. CloudTrail data events show API calls like GetObject, while S3 server access logs record detailed request information. AWS Config, GuardDuty findings, and Trusted Advisor do not provide the raw access logs required to trace data exfiltration.

Answer

AWS Trusted Advisor S3 bucket permissions check

Answer

Amazon GuardDuty S3 protection findings

Answer

AWS Config configuration history

Question 4

You are a SOC analyst for a company using Google Cloud Platform. You need to detect anomalous activity in your GCP environment. Which two of the following log sources should you prioritize to identify potential security incidents related to IAM and resource configuration changes? (Choose two.)

Accepted Answer

Cloud Audit Logs: Admin Activity. Admin Activity logs are always enabled and capture all API calls that modify resource configurations, including IAM changes. Access Transparency logs record access by Google personnel, which is vital for detecting insider threats or unauthorized access to your environment. Together, they provide visibility into both user-initiated and Google-initiated changes that could indicate a security incident. Other log types like Data Access or VPC Flow Logs focus on data reads or network traffic, not configuration changes.

Answer

VPC Flow Logs

Answer

Cloud Audit Logs: System Event

Answer

Cloud Audit Logs: Data Access

Question 5

A SOC analyst is reviewing Azure activity logs and notices a suspicious role assignment: a user was granted the Owner role on a subscription at 2:00 AM. The analyst needs to determine who performed this action and from which IP address. Which Azure log should the analyst query?

Accepted Answer

Azure Activity log. The Azure Activity log captures control plane operations, including role assignments, and provides details like the caller identity, operation name, and source IP address. This is the correct log to determine who granted the Owner role and from which IP. Microsoft Entra ID audit logs focus on Microsoft Entra ID objects, while sign-in logs only show authentication events. Azure Monitor activity log is essentially the same as the Activity log, but the standard term is 'Azure Activity log'.

Answer

Azure Monitor activity log

Answer

Azure AD sign-in logs

Answer

Azure Active Directory audit logs

Question 6

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers provides endpoint detection and response (EDR) capabilities through the integrated Defender for Endpoint agent, which captures process-level telemetry including command lines, parent-child process relationships, and file hashes. This is exactly what is needed to identify cryptomining binaries like XMRig and their execution chain on a compromised VM. Defender for Servers surfaces these events in the Microsoft 365 Defender portal for investigation.

Answer

Azure Advisor

Answer

Azure Network Watcher

Answer

Azure Resource Graph

Question 7

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

Accepted Answer

S3 Data Events. AWS GuardDuty uses S3 Data Events (CloudTrail S3 data events) as the data source to detect unusual S3 bucket access. When you enable S3 Protection in GuardDuty, it analyzes CloudTrail management and data events for S3, such as GetObject, PutObject, and DeleteObject, to identify suspicious activity like anomalous API calls or unusual user behavior. Without S3 Data Events enabled, GuardDuty cannot monitor object-level operations in S3 buckets.

Answer

VPC Flow Logs

Answer

EBS Snapshot logs

Answer

Route 53 Resolver query logs

Question 8

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

Accepted Answer

Security Command Center. Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. It surfaces misconfigurations, vulnerabilities, and threats — including IAM-based findings such as service accounts granted excessive permissions — through built-in detectors and Security Health Analytics.

Answer

Cloud Trace

Answer

Deployment Manager

Answer

Cloud Billing

Question 9

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

Accepted Answer

Microsoft Entra ID Sign-in logs. Microsoft Entra ID (formerly Azure AD) Sign-in logs capture authentication events including the geographic location (via IP geolocation), device details, and risk level (when Identity Protection is enabled). This is the correct place to investigate suspicious VM or user sign-in patterns.

Answer

Azure Policy Compliance dashboard

Answer

Azure Monitor Metrics

Answer

Azure Service Health

Question 10

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Accepted Answer

Modify Security Group to deny all traffic. The standard cloud-native isolation technique for a compromised EC2 instance is to modify its Security Group to deny all inbound and outbound traffic (or attach a pre-built 'quarantine' SG). This preserves the instance's memory, EBS volumes, and forensic state while cutting off C2 channels and lateral movement. It is non-destructive and reversible, unlike termination or volume deletion.

Answer

Remove the IAM Role

Answer

Disable the VPC

Answer

Terminate the instance