A company’s content management system (CMS) service runs on an IaaS cluster on a public cloud. The CMS service is frequently targeted by a malicious threat actor using DDoS. Which of the following should a cloud engineer monitor to identify attacks?
The correct answer is:
A. Network flow logs
⸻
✅ Explanation:
To detect DDoS (Distributed Denial-of-Service) attacks, the most relevant and effective log source is:
🔍 Network flow logs, which capture:
• Source and destination IP addresses
• Ports and protocols used
• Volume of traffic over time
• Traffic patterns across your infrastructure
This allows cloud engineers to identify:
• Traffic spikes
• Unusual patterns (e.g., many requests from a single or multiple IPs)
• Flooding behavior indicative of DDoS
@BlueMan93 I hear you.. although I don't believe EDR solutions are available for a lot of CMS or IaaS platforms.
Network flow logs achieve the same goal (for this question) however are a bit more of agnostic and typically are included with most CMS or IaaS solutions.
I'll stick with A unless someone can prove otherwise.
I would go with B for this one. Endpoint Detection and Response (EDR) systems help secure networks by identifying vulnerabilities and misconfigurations and continually monitor the network.
upvoted 1 times
...
This section is not available anymore. Please use the main Exam Page.CV0-004 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Justheretolook
1 week, 2 days agocwilson91
6 months agoBlueMan93
6 months, 1 week ago