CCSE Security Operations & Monitoring Flashcards

What is the primary function of a Cloud Security Operations Center (Cloud SOC)?

Answer: Continuously monitoring cloud environments to detect, analyze, and respond to security threats

A Cloud SOC is a dedicated team using tools and processes to monitor cloud environments 24/7 for security incidents and threats.

Which metric measures the average time from when an attack occurs to when it is detected by the security team?

Answer: Mean Time to Detect (MTTD)

Mean Time to Detect (MTTD) measures detection speed; lowering it is a key SOC goal to reduce dwell time of attackers.

In cloud security monitoring, what is a SIEM used for?

Answer: Aggregating, correlating, and analyzing security logs to identify threats

A Security Information and Event Management (SIEM) system collects logs from multiple sources and uses correlation rules to detect suspicious activity.

Which cloud monitoring approach continuously evaluates infrastructure configurations against security baselines and flags deviations?

Answer: Cloud Security Posture Management (CSPM)

CSPM tools automatically assess cloud configurations against security best practices and compliance frameworks, alerting on misconfigurations.

What is the purpose of network flow logs (e.g., AWS VPC Flow Logs) in cloud security monitoring?

Answer: To capture metadata about IP traffic to and from network interfaces for threat detection

VPC Flow Logs capture source/destination IP, port, protocol, and action data, enabling detection of unusual traffic patterns and unauthorized access.

Which concept describes the practice of assuming an attacker is already inside the network and building monitoring accordingly?

Answer: Zero Trust security model

Zero Trust assumes no user or system inside or outside the network is trusted by default, requiring continuous verification and monitoring.