Chapter 8 of 8 · EC-Council 312-39
SOC for Cloud Environments
Azure and Microsoft Sentinel, AWS Security Hub and GuardDuty, Google SCC and Security Operations, worth 5%.
- 3topics
- 14 minfast track
- 5%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Azure SOC Architecture and Microsoft SentinelLearn the Azure SOC architecture, Microsoft Sentinel as SIEM and SOAR, Defender for Cloud, Defender XDR and the Azure log sources…4 min
- 2AWS SOC Architecture and AWS Security HubLearn the AWS SOC architecture, AWS Security Hub, GuardDuty, CloudTrail, Detective, Inspector, Macie and the AWS log sources a…5 min
- 3GCP SOC, Security Command Center and Google Security OperationsLearn the Google Cloud SOC architecture, Security Command Center, Google Security Operations (formerly Chronicle) and GCP log…5 min
About this chapter
What this chapter covers
SOC for Cloud Environments is 5% of the EC-Council CSA 312-39 exam. It covers how a SOC monitors the three major clouds: the Azure SOC architecture with Microsoft Sentinel, the AWS SOC architecture with AWS Security Hub, and the Google Cloud SOC architecture with Security Command Center and Google Security Operations (formerly Chronicle).
Questions are single-answer multiple choice, often "Which of the following" and short named scenarios. You are asked what an alert, log entry or IoC means and what the next triage or response step should be, and which cloud service does a given job.
It has 3 outline topics, and three pages cover them, one per cloud.
How the topics fit together
Each cloud follows the same pattern: logs feed detection services, findings flow to a central hub or SIEM, and automation helps respond.
- Azure: Microsoft Sentinel is the SIEM and SOAR, with Defender for Cloud and Defender XDR as major sources.
- AWS: CloudTrail and GuardDuty feed Security Hub, with EventBridge driving automated response.
- Google Cloud: Security Command Center finds issues, and Google Security Operations correlates and responds.
Learn one "who did what" log per cloud: the Azure Activity log, AWS CloudTrail and Google Cloud Admin Activity audit logs. Many questions ask which log answers that question.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to name the next step for each short scenario before reading the answer. The exam often asks what to do first, or which tool fits.
Ready for more practice?
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.