Cloud Security Operations practice questions

Use the cloud provider's organizational structure and enable a single audit logging configuration that delivers logs to a central storage container in the management account.

AWS Organizations lets you attach a single organisation-wide CloudTrail trail delivering every account's logs to one central S3 bucket in the management or security account. S3 lifecycle policies then transition objects to cheaper classes after 90 days, meeting both centralisation and cost-retention requirements.

Modify the security group to deny outbound traffic

Security groups are stateful virtual firewalls applied at the instance's network interface, so denying outbound traffic immediately blocks the port scanning without terminating the instance or losing volatile memory evidence. This satisfies the requirement to isolate the compromised VM first while preserving forensic data for later analysis.

CloudTrail data events for S3

CloudTrail data events record object-level S3 operations such as GetObject, capturing who accessed which object and when. This is the only source that reveals the actual read activity underpinning mass exfiltration, satisfying the requirement to correlate bulk object retrieval rather than mere bucket-level management calls.

VPC Flow Logs

VPC Flow Logs capture IP traffic metadata for network interfaces, exposing the volume and destination of data leaving the VPC. Correlating unusually large outbound transfers with S3 access activity satisfies the exfiltration detection requirement, since it evidences the egress channel rather than the API call itself.

S3 server access logs

S3 server access logs record every request against a bucket, including requester, operation and bytes sent. Aggregating these entries exposes abnormally high-volume downloads, directly satisfying the mass-exfiltration detection goal by quantifying data transferred per identity over the correlation window.

Cloud Asset Inventory

Cloud Asset Inventory exports resource configuration metadata and history to Pub/Sub or BigQuery, enabling continuous evaluation against CIS Benchmark controls. It satisfies the stem's monitoring requirement by feeding configuration data into analysis pipelines, complementing Security Command Center's built-in posture findings.

Security Command Center

Security Command Center continuously assesses GCP resources against built-in and custom detectors, including CIS Benchmark controls, surfacing misconfigurations through its Security Health Analytics and posture management features. This directly satisfies the requirement for continuous configuration monitoring against the CIS Benchmark without deploying third-party tooling.

Delete the Lambda function

Deleting the Lambda function removes the attacker's malicious code from the account, preventing further invocation. This is a core eradication step: it eliminates the unauthorised resource itself, complementing revocation of the attacker's credentials and removal of any persistence mechanisms they established.

Review and remove any CloudWatch Events triggers

CloudWatch Events (EventBridge) rules can invoke the Lambda on a schedule or in response to API activity, so the attacker's function would be re-triggered even after deletion. Removing these triggers first breaks the persistence mechanism, satisfying the eradication requirement to eliminate all invocation paths.

Revoke any IAM roles associated with the function

The Lambda assumes an IAM execution role whose permissions the attacker could abuse for lateral movement or re-creation of resources. Deleting or revoking that role's policies removes the function's privilege to act, which is essential to eradication rather than merely stopping invocation.

Azure SQL databases (Defender for Databases)

Enabling the Defender for Databases plan extends Azure Defender's threat detection to Azure SQL databases, covering anomalous access and injection attempts. This satisfies the hybrid-environment constraint because the plan protects Azure-hosted SQL workloads alongside on-premises assets surfaced through Microsoft Entra ID-integrated subscriptions.

Azure Key Vault (Defender for Key Vault)

Defender for Key Vault is a distinct Azure Defender for Cloud plan that monitors Key Vault access and secret retrieval, protecting that resource type and satisfying one of the three selections the hybrid-environment question demands.

Virtual machines (Defender for Servers)

Defender for Servers extends Azure Defender coverage to virtual machines, including on-premises and multicloud hosts via Azure Arc, satisfying the hybrid-environment constraint in the stem. Enabling this plan provides threat detection, vulnerability assessment and endpoint protection for server workloads, so virtual machines qualify as one of the three protectable resource types.

Log file integrity validation

Log file integrity validation produces a cryptographic hash chain over delivered log entries, letting the team recompute digests and detect any post-delivery modification. This satisfies the requirement to verify that audit log files remain unaltered since delivery, exposing tampering by the attacker.

Use a serverless function to pull findings from the findings service API and push to Splunk HTTP Event Collector.

A serverless function polls the findings service API and forwards results to Splunk's HTTP Event Collector, avoiding polling infrastructure and manual export. This is the most efficient ingestion path, satisfying the requirement to bring cloud security findings into Splunk with minimal operational overhead.

CloudTrail management events and AWS CloudTrail authentication events

CloudTrail management events capture API activity such as ConsoleLogin, while authentication events record sign-in outcomes, together supplying the identity, timestamp and source IP address needed to geolocate each login. Correlating these across accounts lets the SIEM compute travel velocity between successive authentications, satisfying the short-timeframe, two-country constraint.

Modify the network security rule associated with the instance to deny all traffic.

Modifying the security group to deny all traffic severs the instance's network path immediately, halting command-and-control and lateral movement. Because it alters only perimeter rules, the instance's memory, disk and logs remain untouched, preserving volatile forensic evidence for later capture.

Check cloud audit logs for the access key events, then rotate the access key.

Audit logs confirm whether the access key genuinely provisioned those instances and reveal the full API call sequence, establishing compromise before acting. Rotating the key immediately then invalidates the credential, containing further misuse while preserving evidence for the investigation.

Revoke IAM credentials associated with the compromised access.

Revoking the IAM credentials tied to the compromised access immediately halts further S3 operations by that principal, containing the exfiltration. It preserves the bucket and its contents for forensic evidence collection rather than destroying them.

Enable VPC Flow Logs for the VPC where the bucket is accessed.

VPC Flow Logs capture IP traffic metadata for the VPC's network interfaces, recording source, destination and port for connections reaching the S3 endpoint. This satisfies the evidence-collection requirement by preserving network-level indicators of the exfiltration path, which bucket-level logs alone cannot provide.

Rapid7 InsightVM (agentless via API)

Rapid7 InsightVM scans Compute Engine instances agentlessly by authenticating through APIs and inspecting the hosts remotely, so no software is installed on each VM. This satisfies the agentless constraint while still detecting vulnerabilities across the fleet.

GCP Security Command Center

Security Command Center's built-in detectors, including Security Health Analytics and Web Security Scanner, assess Compute Engine instances without deploying agents. Findings surface vulnerabilities such as missing patches or exposed services, meeting the agentless scanning requirement natively within GCP.

Integration with threat intelligence feeds

Threat intelligence feed integration enriches alerts with indicators such as malicious IPs, domains and hashes, enabling automated triage, prioritisation and blocking decisions. That enrichment is essential for SOAR playbooks to act on incidents without manual analyst research.

Automated playbook execution

Automated playbook execution provides the orchestration engine that triggers and sequences response actions without human intervention, directly satisfying the SOAR requirement to automate workflows. It codifies containment, eradication and recovery steps so cloud incidents are handled consistently and at machine speed.

Case management and reporting

Case management and reporting maintains a centralised record of each incident, tracking artefacts, tasks, timelines and analyst decisions. This satisfies the SOAR requirement for automating workflows by giving responders shared visibility and audit trails, enabling handoffs and post-incident review across cloud environments.

CloudTrail Log File Validation

CloudTrail log file validation generates digest files containing hashes of each delivered log, letting you verify integrity and detect post-delivery modification or deletion. This cryptographic mechanism satisfies the requirement that delivered log files cannot be tampered with, which standard delivery alone does not guarantee.

Create a memory dump by SSH and save to S3

Correct. A memory dump captures volatile data (RAM), and SSH is a common remote access method for initiating the dump. Saving to S3 provides secure storage. Although SSH modifies state, it is the best practical option for volatile data capture in cloud environments.

AWS Security Hub

AWS Security Hub runs automated, continuous checks against CIS AWS Foundations Benchmark controls and aggregates findings, giving native configuration-drift detection. Its security standards mechanism directly satisfies the CIS benchmark posture requirement, unlike CloudTrail or Config rules used in isolation.

Agentless scanning using cloud APIs

Agentless scanning uses cloud provider APIs and snapshot access to inspect VM disks externally, so no software is installed on the guest. This directly satisfies the constraint of scanning virtual machines without deploying an agent across the hybrid estate.

CloudTrail with cross-account log delivery to a central S3 bucket and enable log file validation

CloudTrail delivers account activity logs, and cross-account delivery consolidates every account's trails into one central S3 bucket. Log file validation adds digest files that detect tampering or deletion after delivery, satisfying the immutability requirement without relying on each account's local storage.

CreateAccessKey

CreateAccessKey records the creation of new long-term access keys, exposing an attacker's persistence mechanism. Its timestamp anchors when the adversary established durable credentials, letting investigators correlate subsequent API activity and determine whether the compromise began before or after the suspicious ConsoleLogin.

ConsoleLogin

ConsoleLogin records interactive authentication to the AWS Management Console, including source IP, user agent and MFA usage. Its timestamp establishes when the attacker first gained interactive access, providing the earliest anchor point for the compromise timeline alongside the CreateAccessKey persistence event.