Chapter 1
Cloud Architecture
Course: Comptia Cloud Cv0 004
Subject: Comptia Cloud Cv0004
Chapter: Security
Monitoring is a key component of a cloud security strategy, enabling early detection of threats, response to incidents, and compliance with governance policies. Suspicious activity may indicate misconfigurations, insider threats, malware activity, or external attacks.
1. Event Monitoring
Event monitoring refers to the continuous observation and analysis of system events, logs, user actions, and network traffic within cloud environments. It is a foundational capability in cloud security operations for identifying unauthorized access, insider threats, and behavioral anomalies.
Key Components
- Log Sources:
AWS: CloudTrail (API calls), CloudWatch Logs (app/system logs), VPC Flow Logs (network traffic).
Azure: Azure Monitor, Activity Logs, Log Analytics, NSG Flow Logs.
GCP: Cloud Audit Logs, VPC Flow Logs, Cloud Logging.
- AWS: CloudTrail (API calls), CloudWatch Logs (app/system logs), VPC Flow Logs (network traffic).
- Azure: Azure Monitor, Activity Logs, Log Analytics, NSG Flow Logs.
- GCP: Cloud Audit Logs, VPC Flow Logs, Cloud Logging.
- Detection Tools: