Logging Monitoring And Compliance practice questions

Compute > Defend > Access Control

Why it fails: This section manages runtime access, not platform audit log forwarding.

Monitor > Events > SIEM

Why it fails: This menu does not exist in the platform.

Policy > Compliance > Settings

Why it fails: This is used for policy configuration, not log export settings.

network from vpc.flow_logs where ...

Why it fails: This queries network traffic, not S3 access.

config from cloud.resource where resource.type = 'S3'

Why it fails: This queries the current state, not historical events.

scan from images where ...

Why it fails: This queries image vulnerabilities.

Policy Auto-Fix

Why it fails: While this exists for some items, Webhooks are the standard for custom remediation.

Compliance Policy exclusion

Why it fails: This stops alerts, it doesn't fix them.

RQL Saved View

Why it fails: This is for reporting, not remediation.

Vulnerability Scan

Why it fails: This is for software vulnerabilities.

Compliance Dashboard

Why it fails: This is for policy compliance, not resource inventory.

Log Streaming

Why it fails: This is for data egress.

Application logs

Why it fails: These are internal to the app, not the network infrastructure.

IAM logs

Why it fails: These focus on identity and access.

CloudTrail logs

Why it fails: CloudTrail logs management actions, not network traffic.

network from vpc.flow_logs where ...

Why it fails: This is for network traffic.

scan from images where ...

Why it fails: This is for container images.

audit from cloud.audit_logs where action = 'Admin'

Why it fails: Audit logs track activity, not static configuration state.

Directly in the etcd database

Why it fails: You should not access etcd directly for audit logs.

The container stdout

Why it fails: API logs are not typically sent to stdout.

The host syslog file

Why it fails: K8s API logs are managed by the K8s control plane, not host syslog.

Vulnerability Policy

Why it fails: This monitors software bugs.

File Integrity Monitoring

Why it fails: This monitors file changes.

Network Security Policy

Why it fails: This monitors traffic, not logins.

Configure a Webhook

Why it fails: Webhooks take action, but don't perform the check.

Use an IAM role

Why it fails: IAM roles do not perform tag validation.

Update the Cloud Account metadata

Why it fails: This doesn't perform compliance monitoring.

ISO 27001

Why it fails: Wait, let's stick to the prompt requirements.

Coffee machine maintenance logs

Why it fails: Irrelevant.

Local library book inventory

Why it fails: This is not a cloud compliance domain.

Internal custom project guidelines

Why it fails: These are not provided out-of-the-box.

Export audit logs daily to an encrypted Amazon EBS volume attached to a hardened EC2 instance and take nightly snapshots retained for seven years.

Why it fails: EBS snapshots are mutable and can be deleted by anyone with snapshot permissions, so immutability is not enforced. Managing seven years of snapshots is operationally fragile, and retrieval within four hours depends on manual restore procedures. This design lacks the object-level WORM guarantees and searchability needed for legal hold.

Stream audit logs to an Amazon CloudWatch Logs log group with a seven-year retention setting and restrict access using IAM policies.

Why it fails: CloudWatch Logs retention can be set to a long period, but log events are not immutable; users with sufficient permissions can delete log streams or the log group. IAM policies are access controls, not WORM protections. This approach fails the immutability requirement and cannot reliably satisfy legal hold retrieval guarantees.

Store audit logs in an Amazon S3 bucket with versioning enabled and a lifecycle policy that transitions objects to S3 Glacier Deep Archive after 90 days.

Why it fails: Versioning preserves prior versions but does not prevent deletion of the current object or the entire bucket, so immutability is not guaranteed. Glacier Deep Archive retrieval typically takes longer than four hours, and lifecycle transitions do not enforce a seven-year retention floor, failing both the retrieval-time and retention-duration requirements.

Cloud Security Posture Management (CSPM)

Why it fails: CSPM focuses on compliance and configuration best practices, such as identifying publicly exposed storage or missing patches. It does not provide network traffic analysis or UEBA for detecting active threats. While valuable, it does not address the specific need for network and identity threat detection.

Cloud Trail Log Analysis

Why it fails: CloudTrail log analysis is specific to AWS and focuses on API activity, not network-level anomalies. It is useful for identity-based threats but does not cover Azure or network traffic. The requirement includes both AWS and Azure and network anomalies, so this alone is insufficient.

Host Vulnerability Scanning

Why it fails: Host Vulnerability Scanning identifies software vulnerabilities on hosts but does not detect network anomalies or identity-based threats in real time. It is a preventive control, not a threat detection feature for suspicious activities. It would not fulfill the requirement for monitoring network and identity threats.

Use GCP Cloud Logging's default retention of 30 days and rely on the built-in immutability of logs.

Why it fails: GCP Cloud Logging's default retention is 30 days, which is far shorter than the required seven years. Logs are not immutable by default; they can be deleted by users with appropriate permissions. This option fails to meet both the retention duration and the immutability requirement, making it unsuitable for compliance.

Enable AWS CloudTrail log file integrity validation but store logs in a standard S3 bucket without versioning or Object Lock.

Why it fails: While integrity validation provides a way to detect tampering, storing logs in a standard S3 bucket without versioning or Object Lock means they can be deleted or overwritten. The absence of immutability controls violates the requirement that logs cannot be altered or deleted, even if integrity validation is enabled.

Set up a lifecycle policy in each cloud to delete logs after seven years automatically.

Why it fails: A lifecycle policy that deletes logs after seven years would satisfy the retention period only if it also ensures immutability during that period. However, the action described only deletes logs after seven years and does not address immutability or protection from early deletion. It also does not guarantee retention if logs are manually deleted before the policy triggers.

AWS Config conformance packs for CIS, and aggregate data using a configuration aggregator.

Why it fails: AWS Config conformance packs can evaluate CIS controls, but they require custom setup and do not natively provide the consolidated compliance score and standard-based reporting that Security Hub offers. While aggregation is possible, the reporting output is less direct and does not automatically produce a benchmark compliance report.

Amazon Inspector with CIS assessment rules enabled, and download the assessment report.

Why it fails: Amazon Inspector assesses vulnerabilities in EC2 instances, container images, and Lambda functions; it does not evaluate CIS AWS Foundations Benchmark controls for account-level configuration. Its reports cover software vulnerabilities, not the CIS benchmark. Therefore it cannot produce the required compliance report.

AWS Trusted Advisor with the security category checks, and export the check results.

Why it fails: Trusted Advisor provides best-practice checks but does not map to the full CIS AWS Foundations Benchmark and lacks per-control compliance scoring. Its security checks are a subset of recommended practices, not a formal benchmark assessment. Exporting these results would not satisfy a CIS compliance report requirement.

Enable a multi-Region CloudTrail trail delivering to an S3 bucket, enable S3 Object Lock in governance mode with a 365-day retention period, and grant s3:BypassGovernanceRetention only to the security team's IAM role.

Why it fails: Governance mode allows users with the s3:BypassGovernanceRetention permission to delete objects or shorten retention, so the data is not truly immutable against privileged principals. Because the requirement states that no user, including root, may alter or delete the logs for 365 days, governance mode fails. Compliance mode is the only Object Lock mode that removes the bypass capability, even for the account root user.

Enable a multi-Region CloudTrail trail delivering to an S3 bucket, configure an S3 Lifecycle rule with a 365-day expiration, enable default bucket encryption with SSE-KMS, and enable MFA Delete on the bucket.

Why it fails: A Lifecycle expiration rule actively deletes objects after 365 days, which is the opposite of an immutable 365-day retention requirement and does not prevent earlier deletion. SSE-KMS provides encryption at rest but does not stop a privileged user from calling DeleteObject. MFA Delete raises the bar for deletion but still allows an authenticated principal with MFA to remove objects, so it does not satisfy the no-exceptions requirement.

Enable a multi-Region CloudTrail trail delivering to an S3 bucket, enable S3 Versioning on the bucket, and configure a bucket policy that denies s3:DeleteObjectVersion to all principals except the account root user.

Why it fails: Versioning preserves prior object versions after a delete marker is placed, but a principal with s3:DeleteObjectVersion can permanently remove those versions, so immutability is not guaranteed. Explicitly allowing the root user to delete object versions directly contradicts the requirement that even root cannot alter the logs. Versioning alone is a recovery mechanism, not a retention control, and does not record attempted deletions by itself.

Cloud Logging with a log sink to a Pub/Sub topic that has a message retention duration of seven days, and configure a Cloud Function to archive messages to Cloud Storage.

Why it fails: Pub/Sub message retention is measured in days, not years, and the maximum retention duration is seven days. A Cloud Function archiving messages adds complexity and potential failure points, and the resulting Cloud Storage objects would not be immutable unless a bucket lock is applied. This does not satisfy the seven-year immutable retention requirement.

Cloud Logging with a log sink to a BigQuery dataset that has a default table expiration of seven years, and grant the compliance team BigQuery Data Viewer roles.

Why it fails: BigQuery table expiration deletes tables after the specified period but does not prevent users with sufficient permissions from deleting or modifying data earlier. BigQuery also lacks an immutable retention lock. This approach cannot guarantee that logs remain unaltered for seven years, so it fails the compliance requirement.

Cloud Logging with a log sink to a Cloud Storage bucket that has Object Versioning enabled and a lifecycle rule to move objects to Nearline storage after 30 days.

Why it fails: Object Versioning preserves overwritten or deleted objects but does not prevent a user with storage.objects.delete permission from permanently deleting all versions. A lifecycle rule to Nearline changes storage class but does not enforce retention. Without a bucket lock retention policy, logs can be altered or deleted, failing the immutability requirement.

s3:DeleteObject

Why it fails: DeleteObject removes objects and grants no write capability, so streamed logs could never be delivered. It is tempting because lifecycle cleanup or retention automation legitimately requires DeleteObject, but that is a separate maintenance task from streaming.

s3:ListBucket

Why it fails: ListBucket enumerates objects in a bucket, not write them; log streaming requires s3:PutObject to deliver log files. It is tempting because ListBucket is genuinely needed for read or sync workflows that enumerate bucket contents before retrieval.

s3:GetBucketPolicy

Why it fails: Granting s3:GetBucketPolicy only lets the service principal read the bucket policy document; it cannot write log objects, so streaming fails. It is tempting because that permission belongs to auditing and compliance checks that inspect bucket policies. It would be correct when validating policy configuration, not when delivering logs.

Compliance Dashboard report

Why it fails: The Compliance Dashboard evaluates resources against policy benchmarks and shows current compliance state, not a chronological log of Security Group modifications. It is tempting because it reports on security posture, but it would be the right choice for proving ongoing adherence to a standard, not for reconstructing who changed what.

Alert rule configuration

Why it fails: Alert rule configuration defines the conditions that trigger future alerts; it does not retain or query historical Security Group modification events. It is tempting because alerting sounds like auditing, but the required 30-day retrospective report comes from Prisma Cloud's audit logs or RQL-based investigation, not rule definitions.

Vulnerability management tab

Why it fails: Vulnerability management scans workloads for CVEs and misconfigured packages; it holds no record of Security Group API mutations. It is tempting because it does surface configuration weaknesses, but that is a point-in-time posture view, whereas the auditor needs an audit trail of change events.

Compute Defender console port

Why it fails: Compute Defender console port is a host-defender connectivity setting, unrelated to CloudTrail, which is ingested through AWS APIs and S3, not a Defender console channel. It is tempting because port validation is the right first step when Compute Defenders fail to register with the console.

The Alert severity threshold settings

Why it fails: Alert severity thresholds govern which findings raise notifications, not log ingestion, so tuning them cannot restore missing CloudTrail data. It is tempting because severity settings are a visible Prisma Cloud configuration, and they would be the right focus when alerts fire too often or too rarely.

The local agent status on the EC2 instances

Why it fails: CloudTrail is an AWS control-plane service delivering API activity to S3 or CloudWatch; no agent runs on EC2 instances for it, so local Defender status is irrelevant. It is tempting because agent health is the correct first check when host-based Compute logs, rather than CloudTrail, go missing.

Remove the IAM user

Why it fails: Deleting the IAM user removes the identity entirely, eliminating its legitimate production access rather than suppressing the noisy finding. It is tempting as a quick way to clear the alert, but the correct approach scopes the policy with exceptions or suppressions so genuine excessive-permission findings still surface.

Disable the policy in Policy Settings

Why it fails: Disabling the policy in Policy Settings switches off Excessive IAM Permission across every account, which is the global disable the question explicitly forbids. It is tempting because it instantly stops the alerts, but the correct approach applies scoped suppressions or exceptions that preserve detection elsewhere.

Re-onboard the cloud account

Why it fails: Re-onboarding the cloud account rebuilds the entire integration and re-ingests all resources, which does not change how the Excessive IAM Permission policy evaluates permissions. It is tempting when connector state is suspect, but tuning requires per-policy suppression or exception rules, not a full re-onboard.