CCSE Security Operations & Monitoring Flashcards

What is a security baseline in the context of cloud security operations?

Answer: A documented set of minimum security controls that all cloud resources must meet

A security baseline defines the minimum required configuration and controls for cloud resources, serving as the benchmark for compliance monitoring.

Which AWS service provides continuous monitoring of AWS accounts for malicious activity using threat intelligence feeds?

Answer: AWS GuardDuty

AWS GuardDuty uses machine learning and threat intelligence to continuously monitor CloudTrail, VPC Flow Logs, and DNS logs for malicious activity.

In cloud monitoring, what is the difference between a true positive and a false positive alert?

Answer: True positive is a real threat correctly detected; false positive is a benign event incorrectly flagged as a threat

True positives represent actual security incidents correctly identified, while false positives are legitimate activities incorrectly flagged, wasting analyst time.

What is the role of threat intelligence in cloud security operations?

Answer: Providing context about known attacker TTPs, IoCs, and emerging threats to improve detection

Threat intelligence informs SOC teams about current attack campaigns, known malicious IPs/domains, and attacker techniques to improve proactive detection.

Which framework provides a knowledge base of adversary tactics, techniques, and procedures (TTPs) useful for improving cloud SOC detection rules?

Answer: MITRE ATT&CK

MITRE ATT&CK is a globally accessible knowledge base of adversary behavior used to build detection rules, threat models, and red team scenarios.

What does SOAR stand for in cloud security operations?

Answer: Security Orchestration, Automation, and Response

SOAR platforms integrate security tools, automate repetitive tasks, and orchestrate response workflows to improve SOC efficiency and speed.