Courseiva

CCNA Soc For Cloud Environments Questions

32 questions · Soc For Cloud Environments topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
Multi-Selecthard

Which THREE of the following are benefits of using a SIEM integrated with Cloud native logs?

Select 3 answers
A.Centralized visibility across multiple cloud providers
B.Advanced threat hunting and long-term analytics
C.Automatic patching of guest OS kernels
D.Correlation of events across different security layers
E.Automated creation of new cloud accounts
AnswersA, B, D

Ingesting logs from AWS, Azure and GCP into one SIEM correlates events across providers, giving a single pane of glass instead of per-provider consoles. This satisfies the benefit of centralised visibility spanning multiple cloud providers.

Why this answer

Option A is correct because a SIEM integrated with cloud-native logs ingests log streams from AWS CloudTrail, Azure Activity Logs, and GCP Cloud Audit Logs into one platform, giving centralized visibility across multiple cloud providers. Option B is correct because the SIEM stores normalized events in a long-term index, enabling advanced threat hunting queries and analytics over historical data that native cloud consoles cannot retain or query at scale. Option D is correct because the SIEM's correlation engine joins events from different security layers (identity, network, workload, and control-plane logs) into a single detection timeline, surfacing multi-stage attacks that isolated tools would miss.

Option C is not a SIEM function; guest OS kernel patching is performed by configuration-management or patch-management tools such as AWS Systems Manager Patch Manager or Azure Update Manager. Option E is not a SIEM function either; creating cloud accounts is an identity/provisioning task handled by services like AWS Organizations or Azure Management Groups, not by log analytics.

Exam trap

The trap is that candidates may select options that sound like general cloud automation benefits (patching, account creation) because they conflate 'cloud integration' with 'cloud management' — but the exam expects you to recognize that SIEM benefits are strictly about visibility, analytics, and correlation, not infrastructure provisioning or OS maintenance.

Practice this question →
2
MCQeasy

A SOC analyst is investigating a security incident in an AWS environment. The analyst needs to determine which AWS API calls were made by a specific IAM user over the past week. Which AWS service should the analyst use to retrieve this information?

A.Amazon GuardDuty
B.AWS Security Hub
C.AWS Config
D.AWS CloudTrail
AnswerD

AWS CloudTrail records API activity in your account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. By filtering CloudTrail logs by the IAM user and the desired time range, the analyst can see exactly which API calls were made. This is the primary service for auditing AWS API activity.

Why this answer

AWS CloudTrail is the service that logs all API activity in an AWS account, capturing details such as the caller identity, timestamp, source IP, and request parameters. By querying CloudTrail event history or delivering logs to S3, a SOC analyst can filter by IAM user and time range to see exactly which API calls were made. Other services like GuardDuty or Security Hub provide derived findings but not the raw audit trail needed for this investigation.

Exam trap

The trap here is confusing threat detection services like GuardDuty with audit logging services like CloudTrail.

Practice this question →
3
MCQhard

A SOC team is reviewing Azure activity logs and notices a series of role assignments being created for a service principal. The assignments grant Owner permissions at the subscription scope. The team needs to identify the exact operation name and the caller's IP address to determine if this is malicious. Which Azure log should they query?

A.Azure Monitor Metrics
B.Azure Activity Log
C.Azure Network Watcher Flow Logs
D.Azure AD Sign-in Logs
AnswerB

The Azure Activity Log records subscription-level control plane operations, including role assignment creations. Each log entry contains the operation name (e.g., Microsoft.Authorization/roleAssignments/write), the caller's identity, and the caller's IP address. Querying the Activity Log for role assignment events will provide the exact information needed to assess whether the service principal's actions are malicious.

Why this answer

The Azure Activity Log is the correct source because it logs all control plane operations at the subscription level, including role assignment creations. It includes the operation name, caller identity, and caller IP address. By filtering for role assignment write operations, the SOC team can identify the exact operation and source IP, enabling them to determine if the service principal's actions are unauthorized.

Exam trap

The trap here is confusing authentication logs with control plane audit logs; sign-in logs show who signed in, but only the Activity Log shows the role assignment operation and caller IP.

Practice this question →
4
Multi-Selecthard

A SOC analyst is investigating suspicious activity in a Google Cloud environment where a service account may have been compromised. The analyst needs to identify evidence of unauthorized use of that service account. (Choose two.)

Select 2 answers
A.Cloud Audit Logs Data Access entries showing API calls made by the service account to read or modify data
B.Security Command Center asset inventory listing IAM policies attached to the service account
C.Cloud Audit Logs Admin Activity entries showing IAM policy changes made by the service account
D.VPC Flow Logs showing the source IP addresses of connections to the service account's resources
E.Cloud Monitoring uptime check results for services associated with the service account
AnswersA, C

Data Access audit logs capture read and write operations on resources such as Cloud Storage objects and BigQuery datasets. When a service account is abused to exfiltrate or alter data, these entries record the principal, method, and resource, directly evidencing unauthorized use of the identity.

Why this answer

Cloud Audit Logs are the authoritative source for service account activity. Admin Activity entries reveal IAM and configuration changes, while Data Access entries reveal reads and writes on data resources. Together they show both privilege changes and data operations performed by the compromised identity, which is the evidence needed to confirm unauthorized use.

Exam trap

The trap here is treating configuration inventory or network flow data as proof of identity abuse, when only Cloud Audit Logs attribute specific API operations to the service account principal.

Practice this question →
5
MCQhard

A SOC analyst is investigating a suspected compromise of an AWS Lambda function. The analyst needs to determine what code was executed and which IAM role the function assumed during the suspicious activity. Which AWS service should the analyst use to review the function's configuration and execution role?

A.AWS Lambda console or GetFunction API
B.AWS X-Ray
C.Amazon CloudWatch Logs
D.AWS CloudTrail
AnswerA

The Lambda console and GetFunction API return the function's configuration, including its execution role, environment variables, and code location. This allows the analyst to see which IAM role the function assumes and to retrieve the code for review. It directly answers both what code ran and which role was used, making it the correct choice for this investigation.

Why this answer

The Lambda console and GetFunction API are correct because they expose the function's configuration, including the execution role and the code package. An analyst can retrieve the role ARN and download the code to review what was executed. CloudTrail, CloudWatch Logs, and X-Ray provide runtime or API-level data but not the function's configured role or code.

Exam trap

The trap here is assuming CloudTrail or CloudWatch Logs contain the function's code and execution role, when those details are only available from the Lambda configuration API or console.

Practice this question →
6
MCQhard

A SOC analyst is investigating a security incident in Microsoft Azure where an attacker may have used a compromised service principal to access resources. The analyst needs to review sign-in activity for the service principal and identify any conditional access policy evaluations. Which Azure log should the analyst query to obtain this information?

A.Azure Activity Log
B.Azure AD Sign-in Logs
C.Azure AD Audit Logs
D.Azure Monitor Logs
AnswerB

Azure AD Sign-in Logs capture authentication events for users and service principals, including the application ID, IP address, location, and conditional access policy status. By querying these logs, the analyst can see successful and failed sign-ins, as well as which policies were applied, providing the necessary details for investigating a compromised service principal.

Why this answer

Azure AD Sign-in Logs are designed to provide details on authentication events, including those for service principals. They include information such as the application ID, sign-in status, conditional access policies applied, and risk details. For a compromised service principal, these logs are critical to determine when and how the principal authenticated, and whether any conditional access policies were bypassed or triggered.

Audit logs and Activity logs serve different purposes and do not contain the required authentication data.

Exam trap

The trap here is assuming that Azure AD Audit Logs or Azure Activity Log capture sign-in events, when in fact only Azure AD Sign-in Logs contain authentication and conditional access details.

Practice this question →
7
Multi-Selecthard

A SOC team is building detection rules for cloud infrastructure. They want to identify potentially malicious activities in AWS that could indicate an account compromise. Which TWO of the following AWS API calls should be monitored as high-priority indicators of compromise? (Choose two.)

Select 2 answers
A.DescribeInstances
B.CreateUser
C.PutBucketPolicy
D.ListBuckets
E.GetCallerIdentity
AnswersB, C

The CreateUser API call creates a new IAM user. In a compromised account, an attacker often creates new users to maintain persistence. Monitoring for CreateUser, especially when followed by AttachUserPolicy or CreateAccessKey, is a high-priority indicator. It is unusual for legitimate users to create new IAM users frequently, so a sudden CreateUser event warrants immediate investigation.

Why this answer

CreateUser and PutBucketPolicy are high-priority indicators because they represent actions that attackers commonly take to establish persistence or exfiltrate data. CreateUser can be used to create backdoor accounts, while PutBucketPolicy can expose sensitive data. These API calls are less frequent in normal operations and have significant security implications, making them valuable for detection.

Exam trap

The trap here is assuming that any unusual API call is an indicator; read-only calls like DescribeInstances or ListBuckets are common and generate noise, so they are not high-priority.

Practice this question →
8
MCQeasy

A SOC analyst is reviewing logs from a cloud environment and needs to determine if an Amazon S3 bucket was made publicly accessible. The analyst wants to identify the specific API call that changed the bucket's access control list (ACL). Which AWS service should the analyst check?

A.Amazon S3 Access Logs
B.Amazon GuardDuty
C.AWS Config
D.AWS CloudTrail
AnswerD

AWS CloudTrail logs all API calls, including PutBucketAcl, which modifies an S3 bucket's ACL. The event record includes the bucket name, the identity of the caller, and the request parameters. By querying CloudTrail for PutBucketAcl events, the analyst can determine when and by whom the bucket was made public, directly addressing the investigation.

Why this answer

AWS CloudTrail is the correct service because it records all API calls, including PutBucketAcl, which is used to change an S3 bucket's ACL. The CloudTrail event includes the caller's identity, the bucket name, and the request parameters, allowing the analyst to determine if and how the bucket was made public. This directly answers the investigation question.

Exam trap

The trap here is confusing S3 Access Logs with CloudTrail; S3 Access Logs record object-level access, not bucket ACL changes or the API call that made the bucket public.

Practice this question →
9
MCQeasy

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

A.Azure Front Door
B.Azure Policy
C.Azure Bastion
D.Azure Key Vault
AnswerB

Azure Policy evaluates resource properties against defined rules and enforces compliance by denying non-compliant deployments or remediating existing resources. It satisfies the stem's requirement for automatic enforcement preventing unauthorised configuration changes, unlike role-based access control, which governs permissions rather than resource settings.

Why this answer

Azure Policy is the governance service that lets you define, assign, and enforce rules (policy definitions) over Azure resources, ensuring they remain compliant with organizational standards and preventing unauthorized or non-compliant changes. It evaluates resource properties against policy rules and can deny non-compliant deployments, audit existing resources, or auto-remediate drift. This directly matches the requirement to automatically enforce security settings and prevent unauthorized changes.

Exam trap

The trap is confusing Azure Policy with Azure RBAC or Azure Security Center recommendations — candidates may pick Key Vault thinking 'security settings' means secrets, but the question is about governance enforcement of resource configuration, which is uniquely Azure Policy's role.

How to eliminate wrong answers

Option A (Azure Front Door) is wrong because it is a global layer-7 load balancer and CDN service for web applications, not a governance or policy enforcement tool. Option C (Azure Bastion) is wrong because it provides secure RDP/SSH access to VMs over TLS without public IPs — it is a connectivity service, not a policy engine. Option D (Azure Key Vault) is wrong because it is a secrets, keys, and certificate management service; it protects cryptographic material but does not enforce configuration or security settings across resources.

Practice this question →
10
MCQmedium

A SOC analyst is reviewing Microsoft 365 audit logs after a user reported a suspicious email. The analyst wants to determine whether the email was delivered to the user's mailbox and whether the user interacted with a malicious URL in the message. Which Microsoft 365 tool should the analyst use to trace message delivery and inspect URL click events?

A.Microsoft Purview eDiscovery (Standard)
B.Microsoft 365 Defender Advanced Hunting with DeviceEvents
C.Exchange admin center message trace
D.Microsoft Defender for Office 365 Threat Explorer
AnswerD

Threat Explorer provides real-time visibility into email and collaboration threats, including delivery status and user interactions such as URL clicks. It allows SOC analysts to filter by sender, recipient, and URL, and to see whether the message was blocked or delivered. This directly answers both the delivery and click-event questions in the scenario.

Why this answer

Threat Explorer in Microsoft Defender for Office 365 is the correct tool because it combines email delivery status with user interaction data such as URL clicks. The analyst can filter by recipient, sender, or URL to confirm if the message reached the mailbox and whether the user clicked the malicious link. The other tools either lack click telemetry or focus on different data sets.

Exam trap

The trap here is assuming that message trace or eDiscovery provides URL click telemetry, when only Threat Explorer correlates delivery and user interaction events.

Practice this question →
11
MCQhard

A SOC team uses AWS Security Hub to centralize findings from GuardDuty, Inspector, and Macie. The team wants to automatically route only high-severity findings to an incident response ticketing system while suppressing informational findings. Which AWS Security Hub capability should the team configure to accomplish this?

A.Security Hub Insights
B.Security Hub custom actions
C.Security Hub automation rules
D.Security Hub finding aggregation
AnswerC

Automation rules evaluate findings against criteria such as severity label and can update fields, suppress findings, or route them. By matching HIGH and CRITICAL severity and setting a workflow status or suppressing informational findings, the team can ensure only high-severity findings proceed to the ticketing integration.

Why this answer

Security Hub automation rules apply criteria to incoming findings and can automatically update, suppress, or route them. Matching severity labels HIGH and CRITICAL while suppressing INFORMATIONAL findings lets the team forward only actionable high-severity findings to the ticketing system without manual triage.

Exam trap

The trap here is confusing Insights or custom actions with automation rules; only automation rules continuously evaluate every incoming finding against criteria and can suppress or route based on severity.

Practice this question →
12
MCQhard

A SOC analyst is investigating a potential compromise in an AWS environment. The analyst suspects that an attacker used a set of temporary credentials obtained from an EC2 instance metadata service. Which AWS service should the analyst review to determine which IAM role was assumed and what actions were taken with those credentials?

A.Amazon GuardDuty
B.AWS IAM Access Analyzer
C.Amazon Inspector
D.AWS CloudTrail
AnswerD

AWS CloudTrail logs all API calls, including those made with temporary credentials from an assumed IAM role. The logs include the role's session name and the identity of the role, allowing the analyst to trace actions back to the specific instance or role. By filtering CloudTrail events by the role's ARN or session name, the analyst can see what actions were performed and from which IP address.

Why this answer

AWS CloudTrail records API activity, including calls made with temporary credentials from an assumed IAM role. The logs contain the role's ARN and session name, enabling the analyst to trace the actions back to the specific role and instance. Other services like GuardDuty, IAM Access Analyzer, or Inspector provide complementary security insights but lack the detailed audit trail required to reconstruct the attacker's actions.

Exam trap

The trap here is thinking that GuardDuty provides detailed API call logs, when it only produces findings based on analyzed logs.

Practice this question →
13
MCQhard

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

A.Cloud Storage Data Access logs
B.Cloud Asset Inventory
C.Cloud Monitoring metrics
D.Cloud Load Balancing logs
AnswerA

Cloud Storage Data Access logs record object-level operations, including `storage.objects.get` calls that name each file read from a bucket. This satisfies the requirement to identify specific file names during exfiltration, since Admin Activity logs only capture configuration changes, not per-object reads.

Why this answer

Cloud Storage Data Access logs record every read and write operation against objects in a bucket, including the identity, timestamp, and specific object names accessed. To identify which files were exfiltrated, the analyst must review these logs for GET/read operations during the alert window. This is the only option that captures per-object access detail.

Exam trap

The trap is confusing configuration/asset inventory tools with data-plane audit logs; candidates must remember that only Data Access logs capture per-object read/write events.

How to eliminate wrong answers

Option B is wrong because Cloud Asset Inventory catalogs resource metadata and configuration, not data-plane access events, so it cannot show which files were read. Option C is wrong because Cloud Monitoring metrics are aggregated time-series (e.g., request counts, bytes), not per-object audit records. Option D is wrong because Cloud Load Balancing logs capture HTTP(S) traffic to backends, not Cloud Storage object-level access.

Practice this question →
14
MCQmedium

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

A.VPC Flow Logs
B.EBS Snapshot logs
C.S3 Data Events
D.Route 53 Resolver query logs
AnswerC

GuardDuty's S3 protection analyses CloudTrail management events by default, but detecting unusual object-level activity such as GetObject or PutObject requires S3 Data Events enabled on the target buckets. That data source supplies the object-level telemetry the scenario demands.

Why this answer

AWS GuardDuty uses S3 Data Events (CloudTrail S3 data events) as the data source to detect unusual S3 bucket access. When you enable S3 Protection in GuardDuty, it analyzes CloudTrail management and data events for S3, such as GetObject, PutObject, and DeleteObject, to identify suspicious activity like anomalous API calls or unusual user behavior. Without S3 Data Events enabled, GuardDuty cannot monitor object-level operations in S3 buckets.

Exam trap

The trap here is confusing network-level logs (VPC Flow Logs) or DNS logs (Route 53 Resolver) with application-level data events; candidates often assume any log source that mentions 'S3' or 'access' is sufficient, but GuardDuty specifically requires S3 Data Events for object-level monitoring.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture IP traffic metadata for network interfaces, not S3 object-level API calls; GuardDuty uses VPC Flow Logs for findings like cryptocurrency mining or port scanning, not S3 access anomalies. Option B is wrong because EBS Snapshot logs are not a native AWS data source; GuardDuty does not use EBS snapshot logs for threat detection—it may analyze EBS volume data for malware but that's a separate feature (Malware Protection) and not related to S3 access monitoring. Option D is wrong because Route 53 Resolver query logs are DNS query logs used by GuardDuty to detect malicious domains or DNS exfiltration, not S3 bucket access patterns.

Practice this question →
15
MCQmedium

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

A.AWS Systems Manager
B.AWS Config
C.AWS CloudTrail
D.Amazon GuardDuty
AnswerC

CloudTrail records every API call as a management event, including the caller identity, action name, timestamp and source IP address. Querying its event history therefore reveals the exact API invocation and originating IP behind the unauthorised role login.

Why this answer

AWS CloudTrail records every API call made in an AWS account, including the identity of the caller, the action performed, the source IP address, and the timestamp. Querying CloudTrail event history or a CloudTrail Lake/Athena-backed trail lets you pinpoint the exact API call and originating IP for the unauthorized IAM role usage.

Exam trap

312-39 often tests whether candidates confuse detection services (GuardDuty) with audit-log services (CloudTrail) — the question asks for the specific API call and source IP, which only CloudTrail provides.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager is for operational management (patching, run commands, session manager) and does not provide API audit logs. Option B is wrong because AWS Config records resource configuration changes and compliance state, not the identity or source IP of API callers. Option D is wrong because Amazon GuardDuty is a threat-detection service that surfaces findings (e.g., anomalous IAM behavior) but does not provide the raw API call detail and source IP — you pivot to CloudTrail for that.

Practice this question →
16
MCQmedium

A SOC analyst in a Microsoft 365 E5 organization is investigating a phishing campaign that successfully compromised a user account. The analyst needs to determine whether the attacker created a mailbox rule that silently forwards incoming mail to an external address. Which Microsoft 365 security feature should the analyst query to retrieve this evidence?

A.Exchange Online Unified Audit Log
B.Microsoft Defender for Cloud Apps activity log
C.Microsoft 365 Defender incidents queue
D.Azure AD sign-in logs
AnswerA

The Unified Audit Log records Exchange mailbox auditing events including New-InboxRule, Set-InboxRule, and forwarding configuration changes. Searching this log for the New-InboxRule operation tied to the compromised user returns the rule parameters such as ForwardTo and the client IP, directly answering the investigation question.

Why this answer

Mailbox forwarding rules created by attackers are Exchange configuration changes, and Exchange mailbox auditing writes them to the Unified Audit Log as operations like New-InboxRule with parameters including ForwardTo and the originating client IP. Querying that log is the authoritative way to confirm rule creation and forwarding destination.

Exam trap

The trap here is assuming that sign-in logs or incident alerts contain mailbox rule details, when only the Exchange Online Unified Audit Log records the New-InboxRule operation and its forwarding parameters.

Practice this question →
17
Multi-Selectmedium

A SOC analyst is monitoring a Google Cloud environment and receives an alert about a potentially compromised service account. The analyst needs to investigate the extent of the compromise by examining audit logs. Which TWO log types should the analyst review to identify actions taken by the service account and any configuration changes made to it? (Choose two.)

Select 2 answers
A.System Event audit logs
B.Policy Denied audit logs
C.Access Transparency logs
D.Data Access audit logs
E.Admin Activity audit logs
AnswersD, E

Data Access audit logs record API calls that read or write user data, such as reading from a Cloud Storage bucket or querying a database. They can reveal if the compromised service account accessed sensitive data, which is essential for assessing data exfiltration or unauthorized access.

Why this answer

Admin Activity and Data Access audit logs are the primary sources for investigating a compromised service account in Google Cloud. Admin Activity logs capture configuration changes, such as IAM policy updates or resource creation, which could indicate privilege escalation or persistence. Data Access logs capture reads and writes to user data, which could reveal data exfiltration.

Together, they provide a comprehensive view of the service account's actions. System Event, Policy Denied, and Access Transparency logs serve different purposes and do not record the service account's successful operations.

Exam trap

The trap here is assuming that Policy Denied logs or System Event logs capture the service account's actions, when they actually record denials or Google-initiated events, not the account's successful API calls.

Practice this question →
18
MCQmedium

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

A.Modify Security Group to deny all traffic
B.Remove the IAM Role
C.Disable the VPC
D.Terminate the instance
AnswerA

Replacing the instance's Security Group with one denying all inbound and outbound traffic severs network access while the EBS volume and instance state remain intact, satisfying the stem's requirement to isolate without deleting the volume.

Why this answer

The standard cloud-native isolation technique for a compromised EC2 instance is to modify its Security Group to deny all inbound and outbound traffic (or attach a pre-built 'quarantine' SG). This preserves the instance's memory, EBS volumes, and forensic state while cutting off C2 channels and lateral movement. It is non-destructive and reversible, unlike termination or volume deletion.

Exam trap

The trap here is confusing 'isolate' with 'remediate' — candidates pick Terminate or Remove IAM Role because they sound decisive, but the question explicitly says 'without deleting the volume,' signaling a forensic-preservation mindset where Security Group isolation is the only non-destructive network cut.

How to eliminate wrong answers

Option B is wrong because removing the IAM Role only revokes AWS API credentials — it does not stop network-based C2, lateral movement, or data exfiltration over the instance's existing network path. Option C is wrong because disabling a VPC is not a supported AWS operation and would disrupt every workload in the VPC, not just the compromised host. Option D is wrong because terminating the instance destroys volatile memory (RAM), which is critical forensic evidence, and may trigger auto-scaling replacement that reintroduces the compromise.

Practice this question →
19
MCQeasy

A SOC analyst is monitoring an Azure environment and receives an alert about a suspicious sign-in from an unfamiliar location. The analyst wants to review the sign-in logs to see the applied conditional access policies and the risk level of the sign-in. Which Azure AD log should the analyst use?

A.Azure AD sign-in logs
B.Azure Activity log
C.Azure Monitor logs
D.Azure AD audit logs
AnswerA

Azure AD sign-in logs provide details about each sign-in attempt, including the applied conditional access policies, the risk level, and the location. They are designed for exactly this investigation. The analyst can filter by user, application, and status to see why the sign-in was flagged. This is the correct log for reviewing sign-in risk and policy evaluation.

Why this answer

Azure AD sign-in logs are the correct source because they contain detailed information about each sign-in, including applied conditional access policies and risk levels. They allow the analyst to see why the sign-in was deemed suspicious. Audit logs, Activity logs, and Azure Monitor logs do not directly provide this information without additional configuration.

Exam trap

The trap here is assuming Azure Monitor logs contain sign-in details by default, when Azure AD sign-in logs are the primary and most detailed source.

Practice this question →
20
MCQmedium

A security analyst is investigating suspicious activity in a Google Cloud environment. The analyst suspects that a service account key was used from an unauthorized location to access Cloud Storage buckets. The analyst needs to identify the source IP address and the specific API method called. Which GCP service should the analyst use?

A.VPC Flow Logs
B.Cloud Asset Inventory
C.Cloud Audit Logs
D.Cloud Monitoring
AnswerC

Cloud Audit Logs record all API calls made in a GCP project, including the identity of the caller, the source IP address, and the specific API method. For service account key usage, the logs show the service account email and the caller's IP. By querying Cloud Audit Logs for Cloud Storage API methods, the analyst can determine if the key was used from an unauthorized location and identify the exact method invoked.

Why this answer

Cloud Audit Logs are the correct choice because they capture all API activity in GCP, including the caller's identity, source IP address, and the specific API method. For a suspected compromised service account key, the analyst can filter logs by the service account email and review the caller's IP and method calls to Cloud Storage, enabling detection of unauthorized access.

Exam trap

The trap here is thinking that VPC Flow Logs can show API-level details; they only capture network traffic, not the identity or method of API calls.

Practice this question →
21
Multi-Selectmedium

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

Select 2 answers
A.Enable global service events
B.Enable Log File Integrity
C.Disable SNS notifications
D.Limit logs to one region
E.Encrypt logs with a public key
AnswersA, B

Global service events captures activity from services such as IAM and CloudFront that are not region-specific, ensuring the audit trail covers account-wide actions rather than only regional API calls, which is essential for a robust security audit.

Why this answer

Option A (Enable global service events) is correct because it ensures CloudTrail captures API activity from global services such as IAM, STS, and CloudFront, which are logged only in the us-east-1 region; without it, critical identity and access events would be missing from the audit trail. Option B (Enable Log File Integrity) is correct because it makes CloudTrail produce digest files with SHA-256 hashes and RSA digital signatures, allowing you to verify that log files have not been altered or deleted after delivery, which is essential for a tamper-evident security audit. Option C is wrong because disabling SNS notifications removes timely alerting on log delivery and is not a security best practice.

Option D is wrong because limiting logs to one region would exclude API activity from other regions, weakening audit coverage. Option E is wrong because CloudTrail logs should be encrypted with AWS KMS (SSE-KMS) or SSE-S3, not a public key, which would be inappropriate for protecting log confidentiality.

Exam trap

The trap is assuming that any encryption or notification setting improves audit robustness; candidates must recognize that global events and log integrity are the two settings that directly strengthen audit coverage and trustworthiness.

Practice this question →
22
Multi-Selecthard

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Select 3 answers
A.Modification of CloudTrail or logging configurations
B.Increased usage of free-tier services
C.Standard scheduled system reboots
D.Successful logins from multiple geographical locations
E.Creation of an IAM user without an MFA device
AnswersA, D, E

Attackers routinely disable or alter CloudTrail trails and logging configurations to erase evidence of their activity. Monitoring for such modifications detects defence-evasion attempts early, satisfying the SOC requirement to identify common cloud account compromise indicators before forensic data is lost.

Why this answer

Option A is correct because attackers routinely disable or tamper with CloudTrail trails, S3 access logging, or GuardDuty to erase their tracks, so any modification of logging configurations is a high-fidelity compromise indicator. Option D is correct because successful authentications from multiple geographically distant locations in a short window suggest credential theft or session hijacking, indicating account takeover. Option E is correct because creating an IAM user without an MFA device is a classic persistence technique used to establish a backdoor identity that survives password resets.

Option B is not a reliable indicator, since free-tier usage is normal for many legitimate accounts and does not by itself signal compromise. Option C is not an indicator at all, as scheduled system reboots are routine maintenance activity rather than malicious behavior.

Exam trap

The trap is selecting plausible-but-benign operational events (free-tier usage, scheduled reboots) as compromise indicators — candidates must distinguish routine activity from attacker tradecraft like disabling logging or creating unsecured IAM users.

Practice this question →
23
MCQmedium

You are a SOC analyst at a company that uses Microsoft 365. You receive an alert that a user's mailbox is being accessed from an unusual location. You need to review the mailbox audit logs to determine which operations were performed and by whom. Which Microsoft 365 tool should you use to search these logs?

A.Microsoft 365 compliance center audit log search
B.Azure Active Directory sign-in logs
C.Exchange admin center mail flow rules
D.Microsoft Defender for Cloud Apps activity log
AnswerA

The Microsoft 365 compliance center (now Microsoft Purview compliance portal) provides an audit log search that queries the unified audit log, which includes mailbox audit events such as MailItemsAccessed, SendAs, and SendOnBehalf. This is the correct tool to investigate mailbox access and operations across Exchange Online, SharePoint, and other services.

Why this answer

The Microsoft 365 compliance center audit log search queries the unified audit log, which captures mailbox operations such as MailItemsAccessed, SendAs, and SendOnBehalf. This is the authoritative source for investigating suspicious mailbox access and determining which operations were performed and by whom. Other tools like Defender for Cloud Apps or Azure AD sign-in logs provide complementary data but lack the granular mailbox audit events needed here.

Exam trap

The trap here is assuming that Azure AD sign-in logs contain mailbox-level operations, when they only show authentication events.

Practice this question →
24
MCQmedium

A SOC analyst notices that an AWS Lambda function's execution role was modified to include the AdministratorAccess managed policy. The change was made outside of any approved change window. The analyst needs to determine who made the modification and from which IP address. Which AWS service should the analyst query to retrieve this information?

A.AWS Trusted Advisor
B.Amazon GuardDuty
C.AWS Config
D.AWS CloudTrail
AnswerD

AWS CloudTrail records API activity in the account, including IAM policy attachment events such as AttachRolePolicy. The event history contains the identity of the caller (user or role), the source IP address, the timestamp, and the request parameters. Querying CloudTrail for the AttachRolePolicy event on the Lambda execution role will reveal exactly who made the change and from where, directly answering the analyst's need.

Why this answer

AWS CloudTrail is the authoritative source for API activity in an AWS account. It logs every API call, including IAM policy attachments, and captures the caller's identity, source IP, and timestamp. By querying CloudTrail event history for the AttachRolePolicy action on the Lambda execution role, the analyst can pinpoint the unauthorized change and its origin, enabling incident response.

Exam trap

The trap here is assuming that AWS Config or GuardDuty provides the identity and source IP of the API caller, when only CloudTrail records those specific audit details.

Practice this question →
25
Multi-Selectmedium

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

Select 2 answers
A.Upgrade the VM's OS image
B.Snapshot the persistent disk for forensics
C.Restrict network ingress/egress rules
D.Increase the VM's CPU quota
E.Delete the VM immediately
AnswersB, C

Snapshotting the persistent disk captures the rogue VM's disk state before remediation, preserving volatile evidence for forensic analysis. This satisfies the forensic requirement, as deleting the VM first would destroy the data needed to investigate the compromise.

Why this answer

Option B is correct because taking a snapshot of the persistent disk preserves volatile and non-volatile evidence (disk state, logs, files) for forensic analysis before any remediation destroys it, which is a standard incident-response step for a rogue VM. Option C is correct because restricting network ingress/egress rules (e.g., via VPC firewall rules or removing the VM's external IP) contains the threat by isolating the rogue VM and preventing lateral movement or data exfiltration while investigation proceeds. Option A is wrong because upgrading the OS image is a patching action that neither contains the rogue VM nor preserves evidence.

Option D is wrong because increasing CPU quota is a performance change unrelated to incident response. Option E is wrong because deleting the VM immediately destroys forensic evidence and may tip off an attacker, so containment and snapshotting must come first.

Exam trap

The trap is choosing to delete the VM immediately, which seems like a quick fix but destroys evidence and may not fully contain the threat.

Practice this question →
26
MCQhard

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

A.Microsoft Defender for Servers
B.Azure Advisor
C.Azure Network Watcher
D.Azure Resource Graph
AnswerA

Microsoft Defender for Servers provides endpoint detection and response, capturing process-level execution telemetry on the VM, including command lines and parent processes. This satisfies the stem's requirement to see process execution details on the suspected cryptomining virtual machine.

Why this answer

Microsoft Defender for Servers provides endpoint detection and response (EDR) capabilities through the integrated Defender for Endpoint agent, which captures process-level telemetry including command lines, parent-child process relationships, and file hashes. This is exactly what is needed to identify cryptomining binaries like XMRig and their execution chain on a compromised VM. Defender for Servers surfaces these events in the Microsoft 365 Defender portal for investigation.

Exam trap

312-39 often tests the distinction between network-layer and endpoint-layer tools, so the trap is choosing Network Watcher because the scenario mentions a VM, when process-level visibility requires an EDR-capable tool like Defender for Servers.

How to eliminate wrong answers

Option B is wrong because Azure Advisor is a recommendation service that suggests cost, performance, and reliability improvements; it does not collect runtime process telemetry. Option C is wrong because Azure Network Watcher provides network-level diagnostics such as flow logs, packet capture, and connection troubleshooting, not process execution details. Option D is wrong because Azure Resource Graph is a query service for resource metadata and configuration across subscriptions, not runtime process activity.

Practice this question →
27
Multi-Selectmedium

Which TWO of the following are primary components of a cloud-native incident response plan?

Select 2 answers
A.Resource Provisioning
B.Budget Optimization
C.Hardware Refresh
D.Containment
E.Eradication
AnswersD, E

Containment is a primary component because it limits the blast radius once a cloud-native incident is detected, isolating compromised identities, workloads or network segments. It satisfies the stem's requirement for a core response phase, sitting between detection and eradication within the incident response lifecycle.

Why this answer

Containment (D) is a primary component of a cloud-native incident response plan because it focuses on limiting the blast radius of a compromise—for example, by isolating affected workloads, revoking IAM credentials, or applying security group and network policy changes to stop lateral movement. Eradication (E) is equally essential, as it removes the root cause and residual artifacts of the incident, such as deleting malicious containers or images, patching exploited vulnerabilities, and rotating compromised keys, before returning to normal operations. Together, containment and eradication form the core response phases that follow detection and analysis in frameworks like NIST SP 800-61.

Resource Provisioning (A) is an operational or infrastructure activity, not an incident response phase, and is not specific to handling security incidents. Budget Optimization (B) is a financial governance concern unrelated to incident response procedures. Hardware Refresh (C) is a lifecycle management task and is largely irrelevant in cloud-native environments where infrastructure is abstracted and ephemeral.

Exam trap

The trap here is confusing general cloud operational activities (provisioning, budgeting, hardware) with the formal incident response lifecycle phases — candidates must recall NIST SP 800-61 phases, not generic cloud management tasks.

Practice this question →
28
MCQeasy

A SOC analyst is reviewing security alerts in an AWS environment and notices a finding that an S3 bucket has been configured with public read access. The analyst needs to identify the IAM principal that made the bucket public. Which AWS service should the analyst check to find the identity that performed the PutBucketAcl or PutBucketPolicy action?

A.AWS Trusted Advisor
B.Amazon GuardDuty
C.Amazon S3 Access Logs
D.AWS CloudTrail
AnswerD

CloudTrail logs all API calls, including PutBucketAcl and PutBucketPolicy, and records the identity of the caller, such as an IAM user, role, or AWS service. By searching CloudTrail for these events, the analyst can determine which principal made the bucket public, along with the source IP and timestamp, which is essential for incident response.

Why this answer

CloudTrail is the definitive source for API activity in AWS, including S3 bucket configuration changes. It logs events like PutBucketAcl and PutBucketPolicy, along with the identity of the caller, enabling the analyst to pinpoint the responsible IAM principal. S3 Access Logs, Trusted Advisor, and GuardDuty each provide different types of information but lack the ability to identify the actor behind a bucket permission change.

Exam trap

The trap here is confusing S3 Access Logs, which record object-level access, with CloudTrail, which records bucket-level configuration changes and the identity of the caller.

Practice this question →
29
MCQmedium

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

A.Cloud Trace
B.Security Command Center
C.Deployment Manager
D.Cloud Billing
AnswerB

Security Command Center's IAM findings continuously scan for service accounts granted excessive permissions, surfacing over-privileged identities through its built-in misconfiguration detectors. This directly satisfies the requirement to detect a service account created with excessive permissions in GCP, unlike audit logs or policy analysers that report activity rather than flagging the risky entitlement itself.

Why this answer

Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. It surfaces misconfigurations, vulnerabilities, and threats — including IAM-based findings such as service accounts granted excessive permissions — through built-in detectors and Security Health Analytics.

Exam trap

The trap is selecting a monitoring or IaC tool (Cloud Trace, Deployment Manager) because it sounds security-adjacent — the exam expects recognition that SCC is the dedicated security posture and threat detection service in GCP.

How to eliminate wrong answers

Option A is wrong because Cloud Trace is a distributed tracing tool for latency analysis, not a security posture tool. Option C is wrong because Deployment Manager is an infrastructure-as-code service for provisioning GCP resources, not for detecting permission issues. Option D is wrong because Cloud Billing reports cost and usage, not IAM or security findings.

Practice this question →
30
MCQmedium

A SOC analyst in an AWS environment receives an alert that an EC2 instance is making unusual outbound DNS queries to a domain associated with command-and-control activity. The analyst needs to identify the full chain of API calls that led to the instance's current state, including any IAM role assumptions or network modifications. Which AWS service should the analyst use to retrieve this information?

A.AWS CloudTrail
B.AWS Config
C.Amazon VPC Flow Logs
D.Amazon GuardDuty
AnswerA

CloudTrail records all API activity in the account, including RunInstances, ModifyNetworkInterfaceAttribute, and AssumeRole events. By correlating the instance ID with CloudTrail events, the analyst can reconstruct the sequence of API calls that created or modified the instance and its associated IAM role, providing the full chain of actions needed for incident response.

Why this answer

CloudTrail is the authoritative source for API activity in AWS, capturing management and data events across services. In this scenario, the analyst needs to correlate the EC2 instance's activity with API calls such as RunInstances, ModifyNetworkInterface, and AssumeRole to understand how the instance was compromised or configured. GuardDuty, AWS Config, and VPC Flow Logs each provide partial visibility but lack the comprehensive API call history that CloudTrail delivers.

Exam trap

The trap here is confusing threat detection findings (GuardDuty) or network logs (VPC Flow Logs) with the API-level audit trail needed to reconstruct the sequence of events.

Practice this question →
31
MCQeasy

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

A.AWS Artifact
B.AWS Security Hub
C.AWS Shield
D.AWS Trusted Advisor
AnswerB

AWS Security Hub aggregates findings from GuardDuty, Inspector, Macie and Config across all accounts into one pane, using the AWS Foundational Security Best Practices standard to flag misconfigurations organisation-wide. This satisfies the stem's centralised, cross-organisation visibility requirement, which single-service tools cannot deliver.

Why this answer

AWS Security Hub is a centralized security and compliance service that aggregates findings from multiple AWS services and partner tools, providing a dashboard to identify misconfigurations and security issues across an organization. It runs automated checks against best practices and standards like CIS AWS Foundations and AWS Foundational Security Best Practices.

Exam trap

The trap is confusing Trusted Advisor (broad best-practice recommendations) with Security Hub (dedicated security findings aggregation and standards compliance) — candidates must recognize Security Hub's specific role as a centralized security dashboard.

How to eliminate wrong answers

Option A is wrong because AWS Artifact is a self-service portal for accessing AWS compliance reports and agreements, not a misconfiguration dashboard. Option C is wrong because AWS Shield is a managed DDoS protection service, not a security posture dashboard. Option D is wrong because AWS Trusted Advisor provides best-practice recommendations including some security checks, but it is not specifically designed as a centralized security misconfiguration dashboard across an organization and lacks the aggregation and standards-based findings of Security Hub.

Practice this question →
32
MCQhard

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

A.Azure Policy Compliance dashboard
B.Azure Monitor Metrics
C.Microsoft Entra ID Sign-in logs
D.Azure Service Health
AnswerC

Microsoft Entra ID Sign-in logs record each authentication attempt with geographic location, IP address, and device risk level, giving the investigation data needed. They are the portal location for reviewing suspicious VM sign-in patterns and assessing risk.

Why this answer

Microsoft Entra ID (formerly Azure AD) Sign-in logs capture authentication events including the geographic location (via IP geolocation), device details, and risk level (when Identity Protection is enabled). This is the correct place to investigate suspicious VM or user sign-in patterns.

Exam trap

The trap is confusing Azure Monitor (performance/operational telemetry) with Entra ID Sign-in logs (identity/authentication events) — candidates pick Azure Monitor Metrics because it sounds like the general monitoring place.

How to eliminate wrong answers

Option A is wrong because Azure Policy Compliance dashboard reports resource configuration compliance against policies, not authentication events. Option B is wrong because Azure Monitor Metrics stores numeric time-series performance data, not sign-in details or risk levels. Option D is wrong because Azure Service Health reports platform outages and planned maintenance affecting Azure services, not user sign-in activity.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Soc For Cloud Environments questions.

Start 20-question session