If an incident response plan fails to contain lateral movement after detection of malware, which proactive control was MOST likely insufficient?

A cloud system generates logs for all administrative actions. During analysis, it is observed that a user accessed resources outside their role. What is the primary failure?

Multi-factor authentication (MFA) is enabled, but attackers still gain access using stolen tokens. Which monitoring capability could have mitigated the attack?

A cloud firewall logs indicate high-volume outbound traffic from an internal VM to unknown IP addresses. Which type of alert is MOST appropriate?

An administrator account is used to access sensitive data outside normal business hours. Which combination of monitoring tools would BEST detect this?

Privilege abuse in cloud systems often occurs due to inherited permissions. Which mitigation strategy is most effective?

A SIEM system raises multiple alerts simultaneously for different anomalies. The security team fails to prioritize, leading to delayed response. Which SIEM feature was underutilized?

Alert fatigue can reduce incident response efficiency. Which design approach reduces false positives?

During an audit, it is found that log records are incomplete for critical cloud actions. Which is the PRIMARY risk?

Automated reporting ensures timely compliance. What is a critical consideration when designing report generation?

A compromised OS image still passes integrity verification. Which tamper-proofing measure is MOST relevant?

If security monitoring introduces latency in a cloud application, which QoS metric is MOST affected?

Integrating security controls should maintain QoS to avoid:

A cloud admin creates accounts without enforcing MFA. Which risk increases the MOST?

If identity federation is misconfigured in a multi-cloud environment, which failure occurs MOST frequently?

SIEM correlates events across multiple sources. Which scenario BEST demonstrates its effectiveness?

An external contractor is provisioned cloud access using federated SSO without validating roles. Which risk arises?

During a cloud attack simulation, the security team notices that malware spreads only to systems with open SSH ports. Which proactive control could have limited this lateral movement?

An employee successfully accesses sensitive data at unusual times without triggering alerts. What monitoring gap MOST likely caused this?