CCNA SOC For Cloud Environments Questions

Multi-Selecthard

Which THREE of the following are benefits of using a SIEM integrated with Cloud native logs?

Select 3 answers

A.Centralized visibility across multiple cloud providers

B.Advanced threat hunting and long-term analytics

C.Automatic patching of guest OS kernels

D.Correlation of events across different security layers

E.Automated creation of new cloud accounts

AnswersA, B, D

SIEM provides a unified view of disparate cloud environments.

Why this answer

SIEM integration allows for cross-platform correlation, long-term log retention, and advanced threat hunting that is difficult to perform in native cloud consoles alone.

Practice this question →

MCQeasy

Your organization uses Google Cloud Platform. You need to identify which service provides VPC flow logs to monitor network traffic patterns between instances. Which service is used?

A.VPC Service Controls

B.Google Cloud Armor

C.Security Command Center

D.Cloud Logging

AnswerD

GCP Flow Logs are written to Cloud Logging for analysis.

Why this answer

VPC Flow Logs in GCP are integrated directly into Cloud Logging to track network connections.

Practice this question →

MCQeasy

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

A.Azure Front Door

B.Azure Policy

C.Azure Bastion

D.Azure Key Vault

AnswerB

Azure Policy is designed for governance and configuration enforcement.

Why this answer

Azure Policy allows you to define rules that enforce compliance and prevent non-compliant resource configurations.

Practice this question →

MCQmedium

You notice an unusual amount of outbound traffic from an Azure VM to a known malicious IP. What is the most effective way to block this traffic immediately at the network level?

A.Update Azure Firewall rules

B.Delete the VM's public IP

C.Disable the Virtual Network

D.Modify the Network Security Group (NSG) outbound rule

AnswerD

NSG rules are the direct and standard way to block specific traffic for a VM.

Why this answer

Network Security Groups (NSGs) allow you to define rules that block outbound traffic from specific VMs or subnets.

Practice this question →

MCQhard

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

A.Cloud Storage Data Access logs

B.Cloud Asset Inventory

C.Cloud Monitoring metrics

D.Cloud Load Balancing logs

AnswerA

Data Access logs provide the audit trail for object-level interactions.

Why this answer

Cloud Storage Data Access logs (found in Cloud Logging) contain granular details about which objects (files) were read or modified.

Practice this question →

MCQmedium

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

A.VPC Flow Logs

B.EBS Snapshot logs

C.S3 Data Events

D.Route 53 Resolver query logs

AnswerC

S3 Data Events provide the necessary logging for GuardDuty to identify suspicious S3 access.

Why this answer

GuardDuty requires S3 Data Events (via CloudTrail) to monitor access patterns at the object level within S3 buckets.

Practice this question →

MCQmedium

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

A.AWS Systems Manager

B.AWS Config

C.AWS CloudTrail

D.Amazon GuardDuty

AnswerC

CloudTrail records AWS API calls and related events for your account.

Why this answer

AWS CloudTrail provides comprehensive logs for all API calls made within an AWS account, including the identity that made the call and the source IP address.

Practice this question →

MCQmedium

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

A.Modify Security Group to deny all traffic

B.Remove the IAM Role

C.Disable the VPC

D.Terminate the instance

AnswerA

Modifying the Security Group effectively isolates the instance from the network.

Why this answer

Modifying the Security Group associated with the instance is the standard practice to isolate it while maintaining the state for forensics.

Practice this question →

Multi-Selectmedium

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

Select 2 answers

A.Enable global service events

B.Enable Log File Integrity

C.Disable SNS notifications

D.Limit logs to one region

E.Encrypt logs with a public key

AnswersA, B

Ensures events from all regions are captured.

Why this answer

Enabling global service events and log file integrity ensure that all actions are captured and that logs remain tamper-proof.

Practice this question →

Multi-Selecthard

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Select 3 answers

A.Modification of CloudTrail or logging configurations

B.Increased usage of free-tier services

C.Standard scheduled system reboots

D.Successful logins from multiple geographical locations

E.Creation of an IAM user without an MFA device

AnswersA, D, E

Attackers often disable logs to hide their tracks.

Why this answer

Unauthorized changes to IAM policies, disabling of logging services, and unexpected creation of resources in unfamiliar regions are top indicators of compromise.

Practice this question →

Multi-Selectmedium

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

Select 2 answers

A.Upgrade the VM's OS image

B.Snapshot the persistent disk for forensics

C.Restrict network ingress/egress rules

D.Increase the VM's CPU quota

E.Delete the VM immediately

AnswersB, C

Crucial for capturing the state before investigation proceeds.

Why this answer

Isolating the VM (network restrictions) and taking a disk snapshot for forensic analysis are the mandatory first steps in response.

Practice this question →

MCQhard

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

A.Microsoft Defender for Servers

B.Azure Advisor

C.Azure Network Watcher

D.Azure Resource Graph

AnswerA

Defender for Servers provides EDR capabilities to monitor processes on virtual machines.

Why this answer

Microsoft Defender for Cloud (specifically the Endpoint protection or integrated EDR) provides process-level visibility and alerts for suspicious activity on VMs.

Practice this question →

Multi-Selectmedium

Which TWO of the following are primary components of a cloud-native incident response plan?

Select 2 answers

A.Resource Provisioning

B.Budget Optimization

C.Hardware Refresh

D.Containment

E.Eradication

AnswersD, E

Containment is necessary to stop the spread of the incident.

Why this answer

Containment and Eradication are essential phases in the standard NIST IR lifecycle as applied to cloud environments.

Practice this question →

MCQmedium

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

A.Cloud Trace

B.Security Command Center

C.Deployment Manager

D.Cloud Billing

AnswerB

SCC monitors IAM policies and detects misconfigurations.

Why this answer

Security Command Center (SCC) provides a dashboard of findings, including misconfigurations and overly permissive IAM roles.

Practice this question →

MCQeasy

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

A.AWS Artifact

B.AWS Security Hub

C.AWS Shield

D.AWS Trusted Advisor

AnswerB

Security Hub is the central console for AWS security findings.

Why this answer

AWS Security Hub aggregates findings from various AWS security services like GuardDuty, Inspector, and Config into a single view.

Practice this question →

MCQhard

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

A.Azure Policy Compliance dashboard

B.Azure Monitor Metrics

C.Microsoft Entra ID Sign-in logs

D.Azure Service Health

AnswerC

Sign-in logs are the primary source for identity-based access investigation.

Why this answer

Azure AD (Microsoft Entra ID) Sign-in logs provide detailed information about user authentication attempts, including risk flags and location data.

Practice this question →