To identify DDoS attacks against a CMS service, a cloud engineer should monitor network flow logs. These logs provide data about the IP traffic going to and from network interfaces in a public cloud, which is essential for detecting the increased traffic volumes typically associated with DDoS attacks. Reference: CompTIA Cloud+ Study Guide (Exam CV0-004) - Chapter on Security in the Cloud