EC-Council CSA · Domain 8 of 8

EC-Council CSA Domain 8: Introduction to Cloud SOC

Introduction to Cloud SOC is 5% of CSA v2 and new in this version. It covers running a SOC for cloud environments and the security monitoring architecture and tools on Azure, AWS and Google Cloud.

Exam weight
5%
Official objectives
4
Estimated questions estimate
~5
Suggested study time estimate
4–6 hrs

About 12 min read Reviewed October 2026

Overview

Domain 8 extends SOC operations into public cloud. It begins with the idea of a SOC for cloud environments: the shared responsibility model, why cloud telemetry differs from on-premises logs, the importance of control plane audit logs, identity as the main perimeter, and challenges such as short-lived resources and multi-account sprawl.

Three objectives then cover each major provider. For Azure, you need the SOC architecture built around Microsoft Sentinel as the cloud-native SIEM and SOAR, with data connectors, KQL analytics rules, incidents and Logic Apps playbooks, supported by Microsoft Defender for Cloud, Microsoft Entra ID logs and Azure Monitor. For AWS, the blueprint names AWS Security Hub for aggregating findings, alongside CloudTrail, GuardDuty, CloudWatch, VPC Flow Logs, Amazon Detective and AWS Config. For Google Cloud, it names Security Command Center and Chronicle, now offered as Google Security Operations, together with Cloud Audit Logs and VPC Flow Logs.

How it's tested

Expect service-matching questions. A cloud monitoring or response need is described, and you pick the provider service that meets it, such as the service that records API calls or the one that aggregates findings. A few questions test shared responsibility and which party must monitor what.

  • Which service does this

    A need such as recording API activity or aggregating findings is described for one provider, and you name the native service.

  • Who is responsible

    A cloud security task is described, and you decide whether the provider or the customer owns it under shared responsibility.

  • Cloud log source

    A cloud investigation question is asked, and you choose the log type that answers it, such as audit logs or flow logs.

Reasoning it through

An analyst needs to know which identity deleted an S3 bucket in an AWS account. VPC Flow Logs might seem relevant because they record traffic, but they capture network metadata, not API actions. Deleting a bucket is a control plane API call, so AWS CloudTrail records the caller identity, time, source IP and request details, and it is the correct log to search.

Objectives 4

Official objectives from the EC-Council outline, in outline order.

8.1 SOC for Cloud EnvironmentsCloud SOC fundamentals and shared responsibility.
What it means
A cloud SOC applies monitoring, detection and response to workloads in IaaS, PaaS and SaaS. Under the shared responsibility model the provider secures the underlying infrastructure, while the customer secures identities, data, configurations and workloads.
What to understand
Cloud monitoring centers on control plane audit logs, identity sign-in logs, network flow logs, workload logs and the provider's native threat detection findings. Misconfiguration and stolen credentials cause many cloud incidents, so posture management and identity monitoring are priorities. Logs from multiple accounts, subscriptions or projects should be centralized, and response often means revoking keys, disabling identities and isolating resources through security groups.
How it shows up
Questions test shared responsibility boundaries and which cloud telemetry matters most.
Common confusion
Assuming the cloud provider monitors customer identities and configurations on the customer's behalf.
8.2 Understand Azure SOC Architecture, Microsoft Sentinel and Security ToolsAzure-native SOC design and tooling.
What it means
Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR, built on a Log Analytics workspace. It ingests data through connectors, detects threats with analytics rules written in KQL, groups alerts into incidents and automates response with playbooks based on Logic Apps.
What to understand
Supporting services include Microsoft Defender for Cloud for posture management and workload protection, Microsoft Entra ID sign-in and audit logs for identity events, Azure Activity Log for control plane operations, and Azure Monitor. Microsoft is consolidating Sentinel into the unified security operations experience in the Microsoft Defender portal, so analysts may work there rather than the Azure portal.
How it shows up
A need such as automated response or posture scoring is described, and you choose the Azure service.
Common confusion
Confusing Microsoft Sentinel, the SIEM and SOAR, with Defender for Cloud, which manages posture and workload protection.
8.3 Understand AWS SOC Architecture, AWS Security Hub and security toolsAWS-native SOC design and tooling.
What it means
AWS Security Hub aggregates and prioritizes security findings from AWS services and partner tools across accounts, and checks resources against security standards. An AWS SOC architecture also relies on CloudTrail, GuardDuty, CloudWatch, VPC Flow Logs, Amazon Detective and AWS Config.
What to understand
CloudTrail records API calls and console activity. GuardDuty analyzes CloudTrail, VPC Flow Logs and DNS logs to produce threat findings. AWS Config tracks resource configuration changes, and Detective helps investigate findings through relationship graphs. EventBridge can trigger automated responses such as Lambda functions. AWS reorganized Security Hub in 2025, so check current console naming when studying.
How it shows up
Expect questions matching an AWS need to the correct service.
Common confusion
Mixing up GuardDuty, which detects threats, with Security Hub, which aggregates findings and checks posture.
8.4 Understand Google Cloud Platform (GCP) SOC Architecture, Security Command Center, Chronicle and security toolsGoogle Cloud SOC design and tooling.
What it means
Security Command Center is Google Cloud's security and risk platform, covering asset inventory, misconfiguration and vulnerability findings, and threat detection such as Event Threat Detection. Chronicle, now marketed as Google Security Operations, provides SIEM and SOAR capabilities at large scale.
What to understand
Cloud Audit Logs record Admin Activity, Data Access, System Event and Policy Denied entries. Admin Activity logs are always on, while most Data Access logs must be enabled. VPC Flow Logs and Cloud DNS logs add network visibility. A typical GCP SOC sends these logs and SCC findings into Google Security Operations for correlation, hunting and automated response.
How it shows up
A need is described for Google Cloud, and you choose between SCC, Security Operations and the relevant log type.
Common confusion
Assuming Data Access audit logs are enabled by default for every Google Cloud service.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Shared responsibility model

    Provider secures the cloud infrastructure; customer secures what runs in it.

    Remember
    Customer owns identities, data and configuration.
    Tested as
    Responsibility questions.
    Trap
    Expecting the provider to watch customer accounts.

  • Control plane audit logs

    Records of management API calls in the cloud.

    Remember
    First stop for who changed what.
    Tested as
    Cloud log questions.
    Trap
    Using flow logs to find API actions.

  • Microsoft Sentinel

    Cloud-native SIEM and SOAR on a Log Analytics workspace.

    Remember
    Uses KQL rules and Logic Apps playbooks.
    Tested as
    Azure service questions.
    Trap
    Calling it a posture tool.

  • Microsoft Defender for Cloud

    Posture management and workload protection for Azure and multicloud.

    Remember
    Produces secure score and recommendations.
    Tested as
    Azure service questions.
    Trap
    Confusing it with Sentinel.

  • Microsoft Entra ID logs

    Sign-in and audit logs for identities.

    Remember
    Key to account compromise investigations.
    Tested as
    Identity questions.
    Trap
    Ignoring identity in cloud incidents.

  • AWS CloudTrail

    Records AWS API calls and console activity.

    Remember
    Answers who did what and when.
    Tested as
    AWS log questions.
    Trap
    Confusing it with CloudWatch metrics.

  • Amazon GuardDuty

    Threat detection from CloudTrail, flow and DNS logs.

    Remember
    Produces findings, not posture checks.
    Tested as
    AWS service questions.
    Trap
    Calling it the findings aggregator.

  • AWS Security Hub

    Aggregates findings and checks against security standards.

    Remember
    Central AWS view across accounts.
    Tested as
    AWS service questions.
    Trap
    Thinking it generates all detections itself.

  • VPC Flow Logs

    Network flow metadata for cloud networks.

    Remember
    No payload, no API activity.
    Tested as
    Network investigation questions.
    Trap
    Using them to find who deleted a resource.

  • Google Security Command Center

    Google Cloud security posture and threat findings platform.

    Remember
    Includes Event Threat Detection.
    Tested as
    GCP service questions.
    Trap
    Confusing it with the SIEM.

  • Google Security Operations

    Google's SIEM and SOAR platform, formerly Chronicle.

    Remember
    Built for large-scale log search.
    Tested as
    GCP service questions.
    Trap
    Treating Chronicle as a separate retired tool.

  • Cloud Audit Logs

    Admin Activity, Data Access, System Event and Policy Denied logs.

    Remember
    Most Data Access logging must be enabled.
    Tested as
    GCP log questions.
    Trap
    Assuming all are on by default.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Native cloud SOC services

ConceptMeaningKey differenceCommon trap
Azure Microsoft Sentinel with Defender for Cloud SIEM and SOAR in one service Swapping Sentinel and Defender roles
AWS Security Hub with GuardDuty and CloudTrail Aggregator plus separate detectors Expecting Security Hub to log API calls
Google Cloud Security Command Center with Security Operations Posture and threats plus SIEM Calling SCC the SIEM

AWS logging and detection services

ConceptMeaningKey differenceCommon trap
CloudTrail API and console activity Who did what Using it for traffic content
VPC Flow Logs Network flow metadata Which hosts talked Expecting API detail
GuardDuty Threat detection findings Analyzes other logs Calling it an aggregator
AWS Config Configuration history and rules What changed in resources Confusing with CloudTrail

Shared responsibility by service model

ConceptMeaningKey differenceCommon trap
IaaS Customer manages OS, apps, data, identities Most customer responsibility Assuming provider patches guest OS
PaaS Provider manages platform runtime Customer keeps data and access Ignoring app configuration
SaaS Provider runs the application Customer keeps identities and data Thinking nothing is left to monitor

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Flow logs show actions

    What candidates pick
    Use flow logs to identify who deleted a cloud resource.
    Why it looks right
    They record cloud activity.
    Why it's wrong
    Flow logs capture network metadata only; API actions are in CloudTrail, Azure Activity Log or Cloud Audit Logs.

    Clue to watch for The question asks which identity made a change.

  2. Provider handles it

    What candidates pick
    Leave identity and configuration monitoring to the cloud provider.
    Why it looks right
    The provider runs the platform.
    Why it's wrong
    Under shared responsibility, customers secure their own identities, data and configurations.

    Clue to watch for The issue is a misconfigured bucket or compromised account.

  3. Security Hub detects everything

    What candidates pick
    Pick Security Hub as the service that analyzes logs to find threats.
    Why it looks right
    It is the central security console.
    Why it's wrong
    GuardDuty generates threat findings; Security Hub aggregates and prioritizes them.

    Clue to watch for The need is detecting malicious activity from logs.

  4. Defender for Cloud is the SIEM

    What candidates pick
    Choose Defender for Cloud to correlate logs and run playbooks.
    Why it looks right
    It has Defender branding and security alerts.
    Why it's wrong
    Microsoft Sentinel is the SIEM and SOAR; Defender for Cloud focuses on posture and workload protection.

    Clue to watch for Correlation or automated playbooks are required.

  5. SCC is the SIEM

    What candidates pick
    Use Security Command Center for long-term log search and correlation.
    Why it looks right
    It is Google Cloud's main security console.
    Why it's wrong
    Google Security Operations provides SIEM search and correlation; SCC focuses on posture and threat findings.

    Clue to watch for The need is hunting across large log volumes.

  6. Host-only response

    What candidates pick
    Respond to a cloud key leak by reimaging the virtual machine.
    Why it looks right
    Reimaging is a familiar fix.
    Why it's wrong
    Leaked keys must be revoked and rotated, and their API activity reviewed, since the attacker does not need the VM.

    Clue to watch for Access keys appear in a public repository.

Answer framework

Use these steps for Domain 8 questions on cloud monitoring and response.

  1. Identify the cloud provider and service model, then decide which party owns the task under shared responsibility, since IaaS customers handle far more than SaaS customers.
  2. Classify the need as audit of API actions, identity activity, network flows, configuration posture, threat detection or SIEM correlation.
  3. Map that need to the native service for the named provider, such as CloudTrail, Entra ID logs, Security Hub, Sentinel or Security Operations.
  4. Check whether the required logs are enabled by default or must be turned on, especially data access logging, which is often off by default.
  5. For response, favor cloud-native actions such as revoking keys, disabling identities and tightening security groups over host-only fixes.

Practice question

A company running workloads in Azure wants one service that collects logs from Entra ID, Azure activity and on-premises firewalls, correlates them with analytics rules, and runs automated response playbooks. Which service should it use?

Want more like this? The EC-Council CSA practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Approach this domain with a provider-by-provider mapping table. Create columns for API audit logging, identity logs, network flow logs, posture management, threat detection and SIEM or SOAR, and fill in the Azure, AWS and Google Cloud service names. That table answers most questions here.

Start with shared responsibility, since several questions hinge on who must monitor what, and write one example per service model. Then go through Azure, the most detailed objective: learn how Sentinel connectors, analytics rules, incidents and playbooks fit together, and how Defender for Cloud and Entra ID logs feed it. If you have a free tier account, enable Sentinel on a small workspace and connect the Activity Log.

For AWS, learn the difference between CloudTrail, GuardDuty and Security Hub precisely. For Google Cloud, focus on Security Command Center, Security Operations and the audit log types. Finally, practice cloud incident scenarios such as leaked keys or a public storage bucket. Since this domain is about five questions, keep study time proportionate.

FAQ

What share of CSA v2 is Introduction to Cloud SOC?

Introduction to Cloud SOC is 5% of the blueprint, about five of the 100 questions. The domain is new in CSA v2.

Which cloud providers does CSA v2 cover?

Microsoft Azure, Amazon Web Services and Google Cloud, with Microsoft Sentinel, AWS Security Hub, and Security Command Center and Chronicle named in the blueprint.

Is Chronicle still the name of Google's SIEM?

Google now markets Chronicle as Google Security Operations. The CSA v2 blueprint uses the Chronicle name, so expect either on the exam.

What is the difference between CloudTrail and GuardDuty?

CloudTrail records API activity in an AWS account. GuardDuty analyzes CloudTrail, flow and DNS logs to detect threats and generate findings.

Who is responsible for monitoring cloud identities?

The customer. Under shared responsibility, the provider secures the infrastructure, while the customer secures identities, data and configurations.

Is hands-on Azure, AWS or Google Cloud experience required for Domain 8?

It helps but is not required. Knowing what each native service does and which logs answer which question covers most of the content.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 8 knowledge

You have covered shared responsibility and SOC architecture on Azure, AWS and Google Cloud. Test whether you can match cloud monitoring needs to the right service.

Take the EC-Council CSA practice test Check your EC-Council CSA readiness

Keep going