CoreQ Academy4.6 Given a scenario, monitor suspicious activities to identify common attacks.
Most cloud attacks leave clear traces in control-plane logs, metrics and billing. Know the patterns.
Detection approaches
- Event monitoring
- Watching control-plane and workload events for risky actions such as new admin users or disabled logging.
- Deviation from the baseline
- Alerting when activity differs from normal: new regions, unusual API calls, traffic spikes.
- Unnecessary open ports
- Exposed management ports (SSH, RDP, databases) found by scanning or configuration review.
Attack types
- Vulnerability exploitation
- Attackers use known weaknesses in exposed services.
- Human error
- Misconfigurations such as public buckets or overly broad permissions.
- Outdated software
- Unpatched images and services with known exploits.
- Social engineering
- Tricking staff into revealing credentials or approving access.
- Phishing
- Fake login pages for cloud consoles and SSO.
- Malware
- Malicious software on cloud workloads.
- Ransomware
- Encrypting or deleting cloud data and backups for extortion; protect backups with immutability and separate accounts.
- DDoS
- Floods that exhaust capacity or budget.
- Cryptojacking
- Stolen credentials used to run crypto-mining. Signs: sudden GPU or large-instance launches in unused regions and a spiking bill.
- Zombie instances
- Forgotten, unmanaged instances that keep running unpatched and can be compromised.
- Metadata
- Abusing the instance metadata service (often via SSRF) to steal temporary credentials. Require token-based metadata access (IMDSv2) and limit instance role permissions.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.6 of the publicly available CompTIA Cloud+ CV0-004 exam objectives (Exam objectives V4, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.