Sample questions
Cse Detection Incident ResponseDifficulty 1
In AWS, what is the primary purpose of CloudTrail from a security detection standpoint?
- aIt records who made which API call, when, and from where.✓
- bIt scans running workloads for malware signatures and quarantines infected files automatically.
- cIt encrypts all data at rest across every AWS service so that stolen disks cannot be read by an attacker.
- dIt replaces the need for IAM policies by enforcing access decisions directly at the network layer.
Explanation:CloudTrail is an audit-logging service: it captures API calls (who, what action, when, source IP/identity) across the account. It does not scan for malware, does not encrypt data, and is not an access-control mechanism — it is the evidence trail used for detection and investigation.
Cse Detection Incident ResponseDifficulty 1
CloudTrail distinguishes between 'management events' and 'data events'. Which statement correctly describes this distinction?
- aManagement events cover control-plane operations like creating or deleting resources (e.g., creating a bucket, modifying a security group), and are logged by default.✓
- bData events are always enabled by default at no extra cost, while management events must be purchased separately.
- cManagement events cover only billing changes, while data events cover only IAM changes, and the two never overlap.
- dManagement events and data events are two names for the exact same log stream, kept only for backward compatibility.
Explanation:Management events are control-plane actions (e.g., creating a bucket, modifying a security group) and are logged by default. Data events (e.g., S3 GetObject/PutObject, Lambda invocations) are high-volume, opt-in, and typically cost extra — important for detecting things like mass object exfiltration.
Cse Detection Incident ResponseDifficulty 1
Conceptually, what makes services like GuardDuty, Microsoft Defender for Cloud, or Google Security Command Center (SCC) different from a plain log viewer?
- aThey replace the need to collect any logs at all, since they generate their own independent evidence from network taps.
- bThey physically isolate compromised hardware in the cloud provider's data center the moment an anomaly is detected.
- cThey continuously analyze signals such as logs and network metadata against threat intelligence and behavioral models to surface findings.✓
- dThey only work if the customer manually uploads known malware hashes into the service every day.
Explanation:Cloud-native detection services correlate multiple signal sources (account activity, network flow metadata, DNS, threat-intel feeds) and apply anomaly/behavioral detection to produce prioritized findings — they are analysis engines, not just log storage or viewers, and they do not perform physical hardware actions.
Cse Detection Incident ResponseDifficulty 1
Why is 'log file integrity validation' (ensuring audit logs cannot be silently altered after being written) considered important for incident response?
- aIt makes the logs load faster in the console, which is purely a performance feature with no security value.
- bIt allows the security team to edit past log entries to correct typos without anyone noticing.
- cIt is required only for cosmetic compliance checkboxes and has no bearing on how an investigation is actually conducted.
- dIt lets investigators prove that the audit trail they are analyzing has not been tampered with.✓
Explanation:If an attacker who gains privileged access could quietly rewrite or delete audit logs, the trail used to reconstruct an incident would be unreliable. Integrity validation (e.g., digest files, hash chaining) gives investigators (and, if needed, courts or auditors) confidence that the evidence is authentic.
Cse Detection Incident ResponseDifficulty 2
An organization runs workloads across dozens of AWS accounts. What is the recommended pattern for collecting audit logs so a security team can detect incidents across the whole environment?
- aLeave each account's logs isolated in that account only, since centralizing logs would violate least-privilege principles.
- bAggregate CloudTrail logs from every account into a centralized, access-restricted logging account.✓
- cAsk each application team to manually export and email their logs to the security team once a month.
- dDisable logging in non-production accounts entirely, since incidents only happen in production.
Explanation:A centralized logging (security/log-archive) account with restricted write access is the standard multi-account pattern: every account's trail delivers to it, giving the security team a single, tamper-resistant place to search and correlate across the whole organization. Isolating logs per account or skipping non-prod logging creates blind spots.
Cse Detection Incident ResponseDifficulty 2
What does 'blast radius' mean in the context of a cloud security incident?
- aThe physical distance between the affected data center and the nearest company office.
- bThe total dollar amount of the cloud bill for the month in which the incident occurred.
- cThe scope of resources, permissions, and data that a compromised identity or resource could reach or affect if fully exploited.✓
- dThe number of support tickets opened by customers after the incident is publicly disclosed.
Explanation:Blast radius describes how far an attacker could realistically pivot or cause damage from a given foothold — which roles it can assume, which resources it can reach, which data it can read or modify. Limiting blast radius (via scoped permissions, network segmentation) is a core containment goal, independent of billing or PR concerns.