CloudSec-Pro Logging Monitoring And Compliance Practice Test 4 — 15 Questions

Question 1

A CloudSec-Pro administrator needs to ensure that all API activity across an AWS organization is captured for security analysis and cannot be disabled by a compromised account. The organization has 50 accounts and requires a single, immutable log destination. Which AWS service should be configured as the primary audit log source?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail with an organization trail delivering to a dedicated logging account's S3 bucket.. An AWS CloudTrail organization trail is the correct choice because it automatically applies to all accounts in the organization and delivers events to a central S3 bucket that can be protected with bucket policies and S3 Object Lock. This ensures comprehensive, tamper-resistant API audit logging across the entire AWS Organization.

Answer

Amazon CloudWatch Logs with a subscription filter to a Lambda function.

Answer

VPC Flow Logs delivered to a central S3 bucket.

Answer

AWS Config with a configuration recorder in each account.

Question 2

A security analyst needs to configure log streaming from Prisma Cloud to a customer-managed Amazon S3 bucket. The bucket is in a different AWS account and uses SSE-KMS encryption with a customer-managed key. The analyst has created the bucket and an IAM role in the target account with a trust policy allowing Prisma Cloud's service principal to assume it. However, test logs are not arriving. Which additional configuration is required on the KMS key policy to allow Prisma Cloud to write encrypted objects?

Accepted Answer

Grant the assumed IAM role kms:Encrypt and kms:GenerateDataKey permissions.. Prisma Cloud writes logs to S3 by assuming a customer IAM role. When the bucket uses SSE-KMS with a customer-managed key, the assumed role must have kms:Encrypt and kms:GenerateDataKey in the key policy. The service principal itself does not write directly. Granting permissions to the service principal or changing encryption does not resolve the missing KMS permissions for the assumed role.

Answer

Add a bucket policy granting s3:PutObject to the Prisma Cloud service principal.

Answer

Grant the Prisma Cloud service principal kms:Encrypt and kms:GenerateDataKey permissions.

Answer

Enable default encryption on the bucket using SSE-S3 instead of SSE-KMS.

Question 3

A CloudSec-Pro analyst is investigating a suspected data exfiltration from an Azure Storage account. The analyst needs to determine which identities accessed the blob container and what operations they performed over the past 14 days. Which Azure feature should be used to obtain this information?

Accepted Answer

Azure Storage diagnostic settings with logs sent to Log Analytics. To investigate data-plane access to Azure Storage, you need diagnostic logging that captures read, write, and delete operations along with caller identity. Azure Storage diagnostic settings route these logs to Log Analytics, where you can query them for the past 14 days. Activity logs and Defender alerts do not provide the full data-plane audit trail required.

Answer

Azure Monitor activity log

Answer

Azure Defender for Storage alerts

Answer

Azure Storage analytics logging (classic)

Question 4

A compliance officer needs to generate a report that shows the organization's adherence to the CIS AWS Foundations Benchmark across all AWS accounts. The report must be exportable and include pass/fail status for each control. Which CloudSec-Pro feature should the officer use?

Accepted Answer

Compliance dashboard with the CIS AWS Foundations Benchmark report. The compliance dashboard in CloudSec-Pro is designed to display and export reports for various compliance standards, including CIS AWS Foundations Benchmark. It aggregates data from all connected AWS accounts, showing pass/fail status per control. This is the most efficient and accurate way for a compliance officer to obtain the required report.

Answer

Investigate tab with a custom RQL query for CIS controls

Answer

Cloud account onboarding wizard

Answer

Alert rules filtered by CIS controls

Question 5

A security team uses CloudSec-Pro to monitor a multi-cloud environment. They need to detect when an IAM user in Azure creates a new service principal and then assigns it a highly privileged role within 10 minutes. Which CloudSec-Pro capability should they use?

Accepted Answer

Correlation policies that chain multiple audit events.. Correlation policies are designed to detect multi-step attack patterns by chaining audit events across a defined time window. By specifying the creation of a service principal followed by a privileged role assignment within 10 minutes, the security team can accurately identify this high-risk sequence, which might otherwise be missed by single-event policies.

Answer

Compliance standards with custom benchmarks.

Answer

Network traffic policies with threat intelligence feeds.

Answer

Anomaly policies with machine learning baselines.

Question 6

A compliance officer needs to generate a report showing all AWS EC2 instances that have been running for more than 90 days without the required 'Environment' tag. The report must be exportable to CSV and scheduled to run weekly. Which Prisma Cloud feature should be used to accomplish this?

Accepted Answer

Configure a Report in the Reports section with a custom RQL query and a weekly schedule.. The Reports section in Prisma Cloud supports custom RQL queries, CSV export, and scheduled execution. It is designed for generating recurring compliance and inventory reports. Other features like Investigate, Compliance Dashboard, and Alert Rules lack the combination of custom query, export, and scheduling needed for this scenario.

Answer

Use the Compliance Dashboard and apply a filter for missing tags.

Answer

Create a custom RQL query in the Investigate tab and export the results manually.

Answer

Set up an Alert Rule with a custom RQL query and configure email notifications.

Question 7

A CloudSec-Pro administrator is configuring Google Cloud Platform (GCP) audit logging for a project that contains sensitive data. The administrator needs to ensure that all administrative activities and data access events are logged, including reads and writes to Cloud Storage buckets. Which audit log type must be enabled?

Accepted Answer

Data Access audit logs. To log data access events such as reads and writes to Cloud Storage, you must enable Data Access audit logs. Admin Activity logs only cover configuration changes, while System Event and Policy Denied logs serve different purposes. Data Access logs are disabled by default and must be explicitly enabled for each service.

Answer

System Event audit logs

Answer

Policy Denied audit logs

Answer

Admin Activity audit logs

Question 8

A CloudSec-Pro analyst needs to investigate a suspicious API call made to an AWS environment. The analyst wants to see the full context, including the user identity, source IP, and the specific API action, and then trace any related resource changes. Which CloudSec-Pro capability should the analyst use to achieve this?

Accepted Answer

The Investigate tab with a query on AWS CloudTrail logs ingested by CloudSec-Pro. CloudSec-Pro's Investigate tab allows querying ingested CloudTrail logs to find specific API calls with full details like user identity, source IP, and action. From there, the analyst can correlate related events by resource or time. This capability is essential for forensic analysis and tracing the sequence of activities during an incident.

Answer

The Compliance dashboard filtered by AWS CIS controls

Answer

The Alerts page filtered by the suspicious API name

Answer

The Asset Inventory filtered by the affected resource

Question 9

A CloudSec-Pro administrator is configuring log streaming to a third-party SIEM. The SIEM requires that logs be delivered in near real-time and that the administrator can filter which log types are sent to reduce noise. Which CloudSec-Pro log streaming configuration should be used?

Accepted Answer

Use the CloudSec-Pro log streaming feature with a supported SIEM integration and apply log type filters.. The native log streaming feature in CloudSec-Pro is built for real-time delivery to SIEMs and supports filtering by log type. This allows the administrator to send only relevant logs, reducing noise while ensuring timely ingestion. Other methods either lack real-time capability, filtering, or both, making them less suitable for this scenario.

Answer

Set up a syslog forwarder on a virtual machine that pulls logs from the CloudSec-Pro API.

Answer

Export logs to an S3 bucket and have the SIEM pull from there on a schedule.

Answer

Configure a webhook integration with a JSON payload and use alert rules to filter events.

Question 10

A CloudSec-Pro security engineer is responsible for monitoring a multi-cloud environment that includes AWS, Azure, and GCP. The engineer needs to correlate security events across all three providers and set up real-time alerts for suspicious activities. Which approach best meets these requirements?

Accepted Answer

Stream logs from all three providers to a centralized SIEM platform that supports multi-cloud ingestion and correlation.. The requirement is to correlate security events across AWS, Azure, and GCP and to set up real-time alerts. A centralized SIEM with multi-cloud connectors can ingest and normalize logs from all three, enabling cross-cloud correlation and immediate alerting. Native tools and batch processing fall short on either cross-cloud visibility or real-time detection.

Answer

Use each cloud provider's native SIEM solution independently and manually correlate events.

Answer

Enable cloud-native security services in each provider and rely on their built-in dashboards for monitoring.

Answer

Export logs to a data lake and use batch processing to generate daily reports.

Question 11

A CloudSec-Pro analyst needs to identify all Amazon S3 buckets that have server access logging disabled and have been accessed by an external account in the last 14 days. Which combination of data sources and query approach is most appropriate?

Accepted Answer

Use AWS CloudTrail Lake to query S3 data events for cross-account access, and correlate the results with AWS Config records for the S3 bucket logging configuration.. Identifying buckets with logging disabled and external access requires combining control-plane configuration data with data-plane access events. AWS Config records the logging configuration, while CloudTrail Lake can query S3 data events for cross-account access over a defined window. Joining these sources produces an accurate, auditable result set.

Answer

Use Amazon GuardDuty findings filtered by S3 bucket access and join them with AWS Trusted Advisor checks for S3 bucket logging.

Answer

Use AWS CloudTrail management events to find s3:GetBucketLogging calls and filter by the external account ID in the userIdentity field.

Answer

Use Amazon Macie to discover sensitive data in S3 and export the bucket list, then manually verify logging status in the S3 console.

Question 12

A CloudSec-Pro administrator is configuring log ingestion from Google Cloud Platform (GCP) to monitor audit activity. The administrator needs to ensure that both administrative activity and data access events are captured. Which two GCP log types must be enabled and ingested into CloudSec-Pro? (Choose two.)

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs capture configuration changes, while Data Access audit logs capture reading or writing of user data. Enabling and ingesting both into CloudSec-Pro ensures comprehensive monitoring of both administrative and data access events in GCP, as required.

Answer

Access Transparency logs

Answer

System Event audit logs

Answer

VPC Flow Logs

Question 13

A cloud security engineer needs to ensure that all AWS CloudTrail logs are retained for at least one year and cannot be altered or deleted by any user, including administrators. Which AWS service should be used to store the logs to meet these requirements?

Accepted Answer

Amazon S3 with Object Lock in compliance mode. S3 Object Lock in compliance mode provides immutable storage for a specified retention period, preventing deletion or alteration even by root users. This meets the requirement for tamper-proof retention of CloudTrail logs for one year. Other options either lack immutability or are not designed for direct log storage.

Answer

AWS Backup with a vault lock policy

Answer

Amazon CloudWatch Logs with a retention policy of 365 days

Answer

Amazon S3 with versioning and MFA delete enabled

Question 14

A security operations center (SOC) analyst is investigating a potential security incident involving an Amazon EC2 instance. The analyst needs to determine which IAM principal launched the instance, the source IP address, and the time of the API call. Which AWS log source should the analyst query to obtain this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs API calls, including the IAM principal, source IP, and timestamp. The RunInstances event would contain the required details. VPC Flow Logs, CloudWatch Logs, and AWS Config do not provide this level of API audit information. CloudTrail is the correct source for investigating who launched an instance and from where.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 15

A CloudSec-Pro team is designing a centralized logging architecture for a multi-account AWS Organization. They need to ensure that all CloudTrail logs are delivered to a single, secure destination and that any attempt to disable logging is detected. (Choose two.)

Accepted Answer

Use AWS Config with a managed rule that detects whether CloudTrail logging is enabled, and configure automatic remediation to re-enable it.. Centralized logging in an AWS Organization is achieved with an organization trail delivering to a protected central S3 bucket. Detection of logging disable attempts is provided by AWS Config rules that monitor CloudTrail status and can auto-remediate. Together they meet the delivery and detection requirements.

Answer

Enable S3 server access logging on the central bucket and store the access logs in the same bucket.

Answer

Deploy a service control policy that allows only the security team to call cloudtrail:StopLogging and cloudtrail:DeleteTrail.

Answer

Enable AWS CloudTrail Insights in each member account and configure Amazon SNS notifications for anomalous activity.