CCSE CCSE Security Operations & Monitoring 2 — Questions and Answers
Question 1: What is a security baseline in the context of cloud security operations?
- The lowest acceptable security standard that triggers automatic alerts
- A documented set of minimum security controls that all cloud resources must meet (Correct answer)
- The initial cost estimate for a cloud security program
- A list of approved cloud service providers
Correct answer: A documented set of minimum security controls that all cloud resources must meet
A security baseline defines the minimum required configuration and controls for cloud resources, serving as the benchmark for compliance monitoring.
Question 2: Which AWS service provides continuous monitoring of AWS accounts for malicious activity using threat intelligence feeds?
- AWS Inspector
- AWS GuardDuty (Correct answer)
- AWS Macie
- AWS Shield
Correct answer: AWS GuardDuty
AWS GuardDuty uses machine learning and threat intelligence to continuously monitor CloudTrail, VPC Flow Logs, and DNS logs for malicious activity.
Question 3: In cloud monitoring, what is the difference between a true positive and a false positive alert?
- True positive is a critical alert; false positive is a low-severity alert
- True positive is a real threat correctly detected; false positive is a benign event incorrectly flagged as a threat (Correct answer)
- True positive uses AI detection; false positive uses rule-based detection
- True positive requires manual investigation; false positive is auto-resolved
Correct answer: True positive is a real threat correctly detected; false positive is a benign event incorrectly flagged as a threat
True positives represent actual security incidents correctly identified, while false positives are legitimate activities incorrectly flagged, wasting analyst time.
Question 4: What is the role of threat intelligence in cloud security operations?
- Automating software deployments
- Providing context about known attacker TTPs, IoCs, and emerging threats to improve detection (Correct answer)
- Managing user authentication workflows
- Optimizing cloud resource costs
Correct answer: Providing context about known attacker TTPs, IoCs, and emerging threats to improve detection
Threat intelligence informs SOC teams about current attack campaigns, known malicious IPs/domains, and attacker techniques to improve proactive detection.
Question 5: Which framework provides a knowledge base of adversary tactics, techniques, and procedures (TTPs) useful for improving cloud SOC detection rules?
- COBIT
- MITRE ATT&CK (Correct answer)
- ITIL
- ISO 27001
Correct answer: MITRE ATT&CK
MITRE ATT&CK is a globally accessible knowledge base of adversary behavior used to build detection rules, threat models, and red team scenarios.
Question 6: What does SOAR stand for in cloud security operations?
- Security Operations, Automation, and Resilience
- Security Orchestration, Automation, and Response (Correct answer)
- System Optimization and Risk Assessment
- Secure Operations and Audit Reporting
Correct answer: Security Orchestration, Automation, and Response
SOAR platforms integrate security tools, automate repetitive tasks, and orchestrate response workflows to improve SOC efficiency and speed.
CCSE CCSE Security Operations & Monitoring 2
What is a security baseline in the context of cloud security operations?