CCSE CCSE Security Operations & Monitoring 2

Question 1

What is a security baseline in the context of cloud security operations?

Accepted Answer

A documented set of minimum security controls that all cloud resources must meet

Answer

A security baseline defines the minimum required configuration and controls for cloud resources, serving as the benchmark for compliance monitoring.

Question 2

Which AWS service provides continuous monitoring of AWS accounts for malicious activity using threat intelligence feeds?

Accepted Answer

AWS GuardDuty

Answer

AWS GuardDuty uses machine learning and threat intelligence to continuously monitor CloudTrail, VPC Flow Logs, and DNS logs for malicious activity.

Question 3

In cloud monitoring, what is the difference between a true positive and a false positive alert?

Accepted Answer

True positive is a real threat correctly detected; false positive is a benign event incorrectly flagged as a threat

Answer

True positives represent actual security incidents correctly identified, while false positives are legitimate activities incorrectly flagged, wasting analyst time.

Question 4

What is the role of threat intelligence in cloud security operations?

Accepted Answer

Providing context about known attacker TTPs, IoCs, and emerging threats to improve detection

Answer

Threat intelligence informs SOC teams about current attack campaigns, known malicious IPs/domains, and attacker techniques to improve proactive detection.

Question 5

Which framework provides a knowledge base of adversary tactics, techniques, and procedures (TTPs) useful for improving cloud SOC detection rules?

Accepted Answer

MITRE ATT&CK

Answer

MITRE ATT&CK is a globally accessible knowledge base of adversary behavior used to build detection rules, threat models, and red team scenarios.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE CCSE Security Operations & Monitoring 2