CCNA Logging Monitoring And Compliance Questions

The Reports section allows creating custom reports based on RQL queries. You can define the query to filter EC2 instances by running duration and missing 'Environment' tag, set the output format to CSV, and schedule it to run weekly. This directly meets all requirements: custom criteria, export, and scheduling.

CloudTrail data events capture object-level API activity for S3, including GetObject, PutObject, and DeleteObject, and record the IAM principal, timestamp, source IP, and bucket/key details. Since the analyst needs to identify who invoked GetObject on a specific bucket at a precise time, data events are the correct log source. Management events would not include the GetObject call because it is a data-plane operation.

A centralized SIEM platform can ingest logs from AWS, Azure, and GCP using native connectors, normalize the data, and correlate events across clouds. It enables real-time alerting and a single pane of glass for security monitoring, which directly addresses the requirement for cross-cloud correlation and timely alerts.

Storing logs in a separate bucket prevents a compromised source bucket from affecting log integrity and simplifies access control. A lifecycle policy to Glacier reduces cost for long-term retention. This aligns with best practices for log isolation and retention, improving both security and compliance.

Defender agents run on hosts to capture process execution and system call activity, giving runtime workload visibility. This satisfies the question's demand for data visibility types, complementing agentless scanning by exposing live kernel-level behaviour rather than static configuration.

Webhook integration settings define the payload structure sent to the configured endpoint, so selecting JSON there controls the alert notification format. This satisfies the requirement that all notifications reach the specific endpoint as JSON rather than email or syslog.

Prisma Cloud requires Jira to be registered under Settings > Integrations before any alert can be forwarded as a ticket. This step establishes the API credentials and webhook binding that the incident-tracking integration depends on, satisfying the stem's requirement for the mandatory configuration action.

Security group rule changes are management events recorded by CloudTrail with event names such as AuthorizeSecurityGroupIngress and RevokeSecurityGroupIngress. The userIdentity field identifies the IAM principal that made the change. CloudTrail retains 90 days of management events by default, covering the 10-day window.

S3 Object Lock in compliance mode makes objects immutable for a defined retention period, and no user, including the root account, can delete or overwrite them. When combined with S3 checksums using SHA-256, each object carries a cryptographic digest that can be validated to prove the file's contents are unchanged. Together they provide both tamper resistance and cryptographic evidence of integrity, exactly what the auditor requires.

S3 Object Lock enforces WORM protection at the storage layer, preventing deletion or modification of log objects for a defined retention period — even by root credentials. This immutability directly satisfies the tamper-evidence constraint, unlike bucket policies or versioning, which remain removable.

AWS CloudTrail records API activity in your AWS account, including the identity of the caller, the source IP address, and the timestamp of the API call. The RunInstances event would show the IAM principal, source IP, and time. This directly answers the analyst's questions. CloudTrail is the authoritative source for AWS API audit logs.

Comprehensive audit logging captures all administrative actions, and centralization in a controlled location facilitates monitoring and analysis. Access controls prevent unauthorized viewing or modification. This is a foundational practice for compliance monitoring, ensuring visibility and integrity of log data across multiple clouds.

Generating reports automatically compiles evidence of policy adherence for auditors and regulators without manual collection. This satisfies the Compliance lifecycle's reporting and attestation phase, converting continuous assessment data into the documented proof required for certification.

Control status (Pass/Fail) provides the binary evidence auditors require to verify each control's operating effectiveness against the stated framework. Recording this per control satisfies the stem's audit-ready constraint, since assessors must trace every requirement to a documented, defensible outcome rather than narrative assurance.

When Prisma Cloud assumes the customer IAM role to write to the S3 bucket, the role's identity is used for the S3 PutObject call. If the bucket uses SSE-KMS with a customer-managed key, the role must have kms:Encrypt and kms:GenerateDataKey in the key policy. Without these, S3 returns an access denied error, and logs are not delivered.

A Policy defines the security check itself — the condition evaluated against cloud resources. An Alert Rule defines the resulting action, such as notification or remediation. This separation satisfies the stem by distinguishing what is checked from what happens when a violation is found.

The Compliance Report captures a point-in-time snapshot mapping RDS configurations against the framework's controls, evidencing encryption at rest. Unlike continuous alert streams, it preserves the assessed state required for audit evidence, satisfying the compliance framework's validation requirement.

The CloudSec-Pro host agent collects runtime telemetry, including process execution and network connection events, and makes it available in the platform for correlation. This data source directly provides the needed visibility into both process and network activity on the Linux host. Analysts can query this data to reconstruct the sequence of events during an investigation.

Granting s3:PutObject allows the Prisma Cloud service principal to write log objects directly into the target S3 bucket, satisfying the requirement for continuous log streaming. This write-only permission is the minimum needed; read or bucket-level actions such as s3:GetObject or s3:ListBucket are unnecessary for delivering logs.

CloudTrail Lake supports SQL-based queries over data events, including S3 GetObject and PutObject calls with the source account identity, enabling identification of external access. AWS Config continuously records S3 bucket properties such as logging configuration. Correlating these two sources in a single query or downstream join yields the required list of buckets meeting both conditions.

Cloud provider management plane logs record control-plane API activity such as resource creation, IAM policy changes and configuration modifications. They satisfy the need to detect privileged abuse and unauthorised infrastructure changes that bypass workload-level monitoring entirely.

The Defender scope specifies which resources the alert policy evaluates, so a Compute alert only fires against the subscriptions, resource groups or workloads explicitly included in that scope. This satisfies the stem's requirement by tying alert generation to defined targets rather than tenant-wide coverage, ensuring Compute alerts remain bounded to the intended assets.

The CloudSec-Pro platform natively ingests audit logs from AWS, Azure, and GCP upon account onboarding, providing a unified log store. Setting a retention policy of 365 days directly meets the regulatory requirement without building separate pipelines. This minimizes operational overhead because the platform handles ingestion and storage centrally, which is the intended design for multi-cloud log management.

Triggering a webhook satisfies the automated response requirement by pushing a JSON payload to an external HTTPS endpoint the moment a policy violation fires, enabling downstream automation such as ticketing or remediation scripts without human intervention. Prisma Cloud supports webhook alerts natively, so no manual review step is needed.

Data Access audit logs record API calls that read or write user data, including Cloud Storage object reads and writes. They are not enabled by default and must be explicitly turned on for each service. Enabling them ensures that all data access events are captured for compliance and forensic purposes.

Direct log forwarding to a Prisma Cloud collector lets on-premises or cloud sources push events straight to the platform, satisfying the ingestion requirement without an intermediary broker. The collector authenticates to Microsoft Entra ID-protected endpoints and normalises raw syslog or CEF into Prisma Cloud's schema, so audit, network and host telemetry arrive in near real time.

Alert rule exceptions with filters suppress matches for known-benign principals, resources or conditions, so genuine excessive-permission findings still fire. This scopes the tuning to specific false positives rather than disabling the policy globally, preserving detection coverage.

Correlation policies in CloudSec-Pro allow you to define a sequence of events that must occur within a specified timeframe. This directly addresses the requirement to detect a service principal creation followed by a privileged role assignment within 10 minutes, enabling precise threat detection.

Admin Activity audit logs record API calls that modify configurations or metadata, such as creating a VM or changing IAM policies. They are enabled by default and are essential for security monitoring. Ingesting them into CloudSec-Pro allows detection of privileged changes across GCP resources.

The CloudSec-Pro compliance dashboard provides pre-built reports for standards like CIS AWS Foundations Benchmark. It aggregates results across all onboarded AWS accounts and allows exporting the report with pass/fail details. This directly meets the officer's need for a consolidated, exportable compliance report.

SSE-KMS with a customer managed key allows you to control and rotate the key annually, and S3 Object Lock in compliance mode prevents any user, including the root account, from deleting or overwriting objects until the retention period expires. This satisfies both encryption and immutability requirements.

The Compliance Dashboard aggregates CIS Benchmark assessments across every connected cloud account, presenting a consolidated posture score and per-control pass/fail status. This directly satisfies the requirement to track overall compliance across multiple accounts from one view, rather than inspecting individual resources or accounts separately.

RQL queries Cloud Security Posture Management resource configuration history, so filtering Security Group modification events over the past 30 days returns the audit trail the auditor requested. Investigate is the console workspace where those saved queries run against stored historical snapshots.

Isolating the affected resource immediately contains the violation, preventing further non-compliant configuration changes or data exposure while remediation proceeds. This directly satisfies the stem's demand for containment as one of three actions following detection of a critical compliance violation.

The Alerts page aggregates every triggered violation across onboarded cloud accounts, giving a consolidated view. It is the console location where policy breaches surface, satisfying the requirement to view all triggered violations rather than per-resource or per-policy detail.

CloudSec-Pro provides native log streaming to popular SIEMs (e.g., Splunk, Microsoft Sentinel) with configurable filters for log types such as audit, alert, and compliance. This delivers logs in near real-time and allows the administrator to exclude noisy log types, meeting both requirements efficiently.

Retention defines how long audit records persist before deletion, satisfying the strategy's requirement to preserve evidence for forensic review and regulatory timeframes. Without a defined retention policy, logs expire prematurely, leaving gaps that undermine the audit trail's completeness and compliance alignment.

CloudSec-Pro ingests AWS CloudTrail logs, which contain detailed API activity including user identity, source IP, and API action. The Investigate tab allows querying this data to find the specific call and then pivot to related events. This provides the full context and traceability needed for the investigation.

The AzureActivity table contains subscription-level control plane operations. Filtering by the delete operation for virtual machines and projecting TimeGenerated, Caller, and ResourceId provides the user, timestamp, and affected resource. This directly answers who deleted the VM and when.

AWS Config can evaluate whether CloudTrail is enabled using a managed rule and trigger automatic remediation to re-enable logging. This detects and corrects attempts to disable logging, fulfilling the detection and response requirement. It complements the centralized organization trail by providing continuous compliance monitoring.

Investigate provides an ad-hoc query interface over aggregated log data, letting you search a specific IP address across all ingested sources without pre-built policies. This satisfies the stem's requirement for immediate, free-text hunting rather than scheduled or policy-driven detection.

Events > Runtime Events shows runtime process activity, including the parent-child relationships forming the process tree for the flagged unauthorised process. This satisfies the need to trace how the process was spawned, which audit or network tabs cannot provide.

Suppression defines a time window during which matching alerts are silenced after the first notification, preventing duplicate tickets for the same recurring condition. This satisfies the requirement to reduce redundant notifications without disabling the rule entirely.

Azure Storage diagnostic settings capture data-plane operations for blobs, files, queues, and tables, including the identity that performed the operation when using Azure AD authentication. Sending these logs to Log Analytics allows you to query and analyze access patterns over the past 14 days using Kusto Query Language.

Prisma Cloud reads CloudTrail through an assumed IAM role, so insufficient permissions there prevent log ingestion entirely. Validating that role's trust policy and attached policies first confirms whether Prisma Cloud can actually access the trail before investigating S3, SNS or region configuration.

Severity level directly satisfies the stem's alert-fatigue constraint by letting analysts triage high-impact detections first, suppressing low-priority noise. Cloud security consoles, including Microsoft Entra ID protection alerts, expose severity as a native filter field, so narrowing the Alerts view to Critical and High reduces volume without discarding actionable incidents.

S3 Object Lock in compliance mode enforces a write-once-read-many (WORM) model, preventing any user, including the root account, from deleting or overwriting objects until the retention period expires. This meets the requirement for immutable retention for at least one year. It is the appropriate service for tamper-proof log storage.

An organization trail created in the management account automatically applies to all member accounts and delivers events to the specified S3 bucket. A bucket policy that allows CloudTrail to write and explicitly denies member accounts s3:DeleteObject and s3:PutBucketPolicy prevents tampering. This meets the requirement for centralized, tamper-resistant logging.

An organization trail applies to all accounts in the AWS Organization and delivers events to a central S3 bucket, typically in a dedicated logging account. This prevents individual account administrators from disabling logging, providing immutable, centralized audit records that CloudSec-Pro can ingest and analyze.