CCSE Security Operations & Monitoring Flashcards

Which log source is most valuable for detecting insider threats in a cloud environment?

Answer: User and Entity Behavior Analytics (UEBA) based on cloud activity logs

UEBA analyzes patterns in user and entity behavior using cloud activity logs to detect anomalous actions that may indicate insider threats.

A cloud SOC analyst notices a spike in failed login attempts from multiple geographic locations against a single account. This pattern suggests:

Answer: A credential stuffing or brute force attack

Multiple failed logins from geographically dispersed IPs targeting one account is a classic pattern for credential stuffing or brute force attacks.

In cloud security monitoring, what is 'alert fatigue' and how does it impact security operations?

Answer: Analysts becoming desensitized to alerts due to excessive false positives, leading to missed real threats

Alert fatigue occurs when analysts receive so many alerts (mostly false positives) that they begin ignoring them, increasing the risk of missing genuine incidents.

What is the purpose of a cloud security dashboard in a SOC environment?

Answer: To provide real-time visibility into the security posture, active alerts, and key metrics across cloud environments

Security dashboards consolidate metrics like open incidents, alert trends, compliance status, and threat activity into a single pane for SOC decision-making.

Which type of cloud monitoring focuses specifically on detecting sensitive data exposure in cloud storage services?

Answer: Data Loss Prevention (DLP) monitoring

DLP monitoring scans cloud storage buckets and data streams to detect sensitive data like PII or credentials that are exposed or being exfiltrated.

In cloud environments, what is the significance of monitoring for 'impossible travel' events in authentication logs?

Answer: It flags when authentication events occur from two geographically distant locations in an impossibly short time, indicating account compromise

Impossible travel detection identifies when the same account authenticates from locations too far apart to travel between in the elapsed time, a strong compromise indicator.