SOC For Cloud Environments

Which THREE of the following are benefits of using a SIEM integrated with Cloud native logs?

Your organization uses Google Cloud Platform. You need to identify which service provides VPC flow logs to monitor network traffic patterns between instances. Which service is used?

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

You notice an unusual amount of outbound traffic from an Azure VM to a known malicious IP. What is the most effective way to block this traffic immediately at the network level?

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Which TWO of the following are primary components of a cloud-native incident response plan?

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?