CCSP Cloud Security Operations — 25 Questions

Question 1

After a security incident involving a compromised access key, a security engineer needs to collect forensic evidence from the cloud environment. Which of the following actions would be most useful for determining the timeline of the compromise?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reviewing cloud audit logs for the compromised key. Cloud audit logs contain detailed records of all API calls, including the identity, timestamp, and source IP. Analyzing these logs helps establish the timeline of when the key was used.

Answer

Taking a memory dump of the compute instance

Answer

Analyzing network flow logs for data exfiltration

Answer

Checking configuration management logs for resource changes

Question 2

A cloud security analyst is configuring a SIEM correlation rule to detect mass data exfiltration from an AWS S3 bucket. Which THREE log sources should be ingested to create an effective detection? (Choose three.)

Accepted Answer

CloudTrail data events for S3. CloudTrail data events for S3 capture object-level API operations such as GetObject, PutObject, and DeleteObject. By monitoring these events, a SIEM can detect anomalous patterns like a sudden spike in read requests from a single IP, which is a strong indicator of mass data exfiltration. This log source provides the granularity needed to identify the specific actions and actors involved in data access.

Answer

AWS Config configuration history

Answer

CloudTrail management events

Question 3

A security engineer is implementing automated incident response for common cloud threats. Which TWO cloud services can be used together to create a serverless orchestration workflow for incident response? (Choose two.)

Accepted Answer

Orchestration service for serverless workflows. An orchestration service for serverless workflows can coordinate multi-step incident response processes, and a serverless compute service can execute the individual remediation actions. Together they form a serverless incident response pipeline.

Answer

Infrastructure as code service

Answer

Virtual machine service

Answer

Vulnerability management service

Question 4

A security engineer needs to ensure that all API calls made to AWS resources are logged for auditing purposes. Which AWS service should be enabled to capture management events, data events, and provide log file validation?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to log API calls and actions taken within an AWS account, capturing management events (e.g., creating or deleting resources) and data events (e.g., S3 object-level operations). It also provides log file validation through digital signatures using SHA-256 hashing and RSA, ensuring the integrity and authenticity of the log files after they have been delivered.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS GuardDuty

Question 5

An organization is using Azure and wants to centrally collect activity logs from multiple subscriptions into a single Log Analytics workspace for cross-account analysis and retention management. What is the best approach?

Accepted Answer

Use Azure Policy to deploy Diagnostic Settings on each subscription to stream Activity Logs to a central Log Analytics workspace.. Azure Policy can enforce the deployment of Diagnostic Settings across all subscriptions, automatically streaming Activity Logs to a central Log Analytics workspace. This ensures centralized collection, cross-account analysis, and retention management without manual configuration per subscription.

Answer

Use Azure Monitor Agent on all VMs to collect logs.

Answer

Enable Azure Sentinel on each subscription and aggregate using cross-workspace queries.

Answer

Use Azure Storage account with event grid to forward logs to a central location.

Question 6

A security engineer needs to scan all container images stored in Amazon Elastic Container Registry (ECR) for vulnerabilities. The scan must be automated whenever a new image is pushed. Which solution meets this requirement?

Accepted Answer

Enable Amazon Inspector continuous scanning for ECR repositories.. Amazon Inspector continuous scanning for Amazon ECR automatically scans container images for software vulnerabilities whenever a new image is pushed to the repository. This feature is natively integrated with ECR, requires no additional infrastructure, and provides findings directly in the Inspector console and via AWS Security Hub. Option D is correct because it is the only AWS-native, automated, and fully managed solution that meets the requirement.

Answer

Use Amazon Macie for image scanning.

Answer

Configure AWS Security Hub to scan images.

Answer

Use AWS Lambda to invoke Clair on each push.

Question 7

A cloud security engineer needs to implement a solution to detect configuration drift against CIS benchmarks for AWS workloads. Which tool or service is specifically designed for cloud security posture management (CSPM) in AWS?

Accepted Answer

AWS Security Hub. AWS Security Hub is a cloud security posture management (CSPM) service that aggregates security findings from multiple AWS services and third-party tools, and it can continuously monitor AWS workloads against CIS AWS Foundations Benchmarks. It provides automated compliance checks, consolidated dashboards, and remediation guidance specifically designed for detecting configuration drift from benchmark standards.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Inspector

Question 8

An incident response playbook for a cloud environment includes containment steps. For a compromised IAM user in AWS, which action is least likely to be effective for containment?

Accepted Answer

Change the IAM user's password. Changing the IAM user's password does not invalidate existing authenticated sessions or tokens (such as temporary credentials from STS or access keys). An attacker who has already established a session or obtained access keys can continue to use them until they expire or are explicitly revoked. Therefore, password change alone is ineffective for immediate containment.

Answer

Disable the IAM user

Answer

Attach a DenyAll policy to the user

Answer

Disable the IAM user's access keys

Question 9

A security analyst notices a spike in failed login attempts from an IP address in a country where the company has no operations. Which SIEM correlation rule would be most effective in detecting this type of activity?

Accepted Answer

Mass S3 download – high volume of GetObject requests from a single IP. A mass S3 download rule detects a high volume of GetObject requests from a single IP, which aligns with the scenario of a spike in failed login attempts from a single IP. While the rule is designed for data exfiltration, it can be adapted to detect any anomalous high-volume activity from a single source, making it the most effective among the given options. Impossible travel (B) requires successful logins from distant locations, not failed attempts, and the other options address different threats.

Answer

Root account usage – alert when root user performs any action

Answer

Impossible travel – login from two geographically distant locations within minutes

Answer

New IAM admin user creation – detection of privileged role assignment

Question 10

A security engineer needs to ensure that all API calls made to cloud resources are logged for auditing. Which cloud auditing feature should be enabled to capture management and data events?

Accepted Answer

Cloud audit logging service. In cloud environments, an audit logging service is the feature designed to log API calls for auditing. It can capture management events (control plane) and data events (data plane) such as object-level operations and function invocations.

Answer

Cloud monitoring and logging service

Answer

Configuration management service

Answer

Threat detection service

Question 11

An organization is setting up a centralized logging solution across multiple accounts in their cloud environment. The security team requires that logs from all accounts be sent to a single security account, with lifecycle policies to transition logs to cheaper storage after 90 days. Which approach should be used?

Accepted Answer

Use the cloud provider's organizational structure and enable a single audit logging configuration that delivers logs to a central storage container in the management account.. For cross-account log aggregation, the cloud provider's organizational structure can be used to centrally manage audit logging. A single audit logging configuration can be enabled that delivers logs from all accounts to a central storage container in the management account. Lifecycle policies on that container can then manage transitions to lower-cost storage classes after 90 days.

Answer

Enable the cloud provider's native audit logging in each account and manually copy logs daily to the security account.

Answer

Create an audit log configuration in each account and export logs to a centralized monitoring service, then use cross-account log forwarding to a central storage container.

Answer

Use a serverless function to copy logs from each account's storage container to the central storage container.

Question 12

A security analyst is investigating a potential breach and needs to verify the integrity of audit logs stored in cloud storage. Which feature should the analyst rely on to confirm that logs have not been tampered with?

Accepted Answer

Log file integrity validation. Integrity verification of audit logs is typically achieved through cryptographic hashing (e.g., SHA-256) and digital signatures provided by the cloud service provider's logging service. This allows the analyst to confirm that logs have not been altered since they were created.

Answer

Server-side encryption of logs

Answer

Anomaly detection on logs

Answer

Immutable storage for logs

Question 13

An organization uses a cloud-based SIEM solution. Which cloud service provides native integration to stream audit logs into the SIEM?

Accepted Answer

Centralized logging service. The centralized logging service can stream audit logs directly to the SIEM via connectors. Many cloud providers offer this native integration, allowing organizations to aggregate and analyze log data centrally.

Answer

Security monitoring service

Answer

Policy management service

Answer

Recommendation service

Question 14

A SOC analyst notices an alert for 'impossible travel' where a user logged in from New York and then from London within 15 minutes. The SIEM correlation rule likely compares which log fields?

Accepted Answer

Source IP address and timestamp. Impossible travel detection typically uses sign-in logs (source IP, geolocation) and event timestamps to identify logins from distant locations within a short time.

Answer

User agent and browser type

Answer

Destination IP and port

Answer

Volume of data transferred and timestamp

Question 15

During a cloud security incident, a security team needs to isolate a compromised virtual machine instance that is performing outbound port scanning. Which containment action should be taken first?

Accepted Answer

Modify the security group to deny outbound traffic. Modifying the virtual machine's security group rules to deny all outbound traffic is a quick and reversible containment action that stops the scanning.

Answer

Terminate the virtual machine instance immediately

Answer

Create a snapshot or image of the virtual machine for analysis

Answer

Detach the virtual machine from the virtual network

Question 16

A security team needs to implement automated remediation for non-compliant resources in a cloud environment. They want to automatically fix public object storage bucket policies. Which combination of services should be used?

Accepted Answer

Configuration management service and serverless compute function. A configuration management service can evaluate resources against compliance rules. When a resource is non-compliant, the service can invoke a serverless compute function to perform automated remediation, such as making a public bucket private.

Answer

Audit logging service and serverless compute function

Answer

Threat detection service and workflow orchestration service

Answer

Security hub and vulnerability management service

Question 17

A cloud security architect is evaluating vulnerability management solutions for a hybrid cloud environment. The team needs to scan both on-premises servers and cloud workloads without installing agents on every system. Which approach is most suitable for cloud workloads?

Accepted Answer

Agentless scanning via cloud APIs (CSPM). Agentless scanning uses cloud APIs to assess vulnerabilities without requiring an agent on each instance. This is ideal for cloud workloads where agents may not be desired.

Answer

Agent-based scanning using a cloud-native service

Answer

Network vulnerability scanning from a remote scanner

Answer

Container image scanning only

Question 18

Which AWS service uses machine learning to detect threats such as crypto mining activity on EC2 instances and compromised IAM credentials?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify malicious activity.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Inspector

Question 19

An organization uses GCP and wants to monitor for threats in real-time, including detecting malicious activity from compromised service accounts. Which GCP service should be used?

Accepted Answer

Event Threat Detection. Event Threat Detection is part of GCP Security Command Center and provides real-time threat detection for IAM anomalies, including compromised service accounts.

Answer

Cloud Audit Logs

Answer

Cloud Security Scanner

Answer

Container Threat Detection

Question 20

A company uses Azure Defender for Cloud to protect its hybrid environment. Which of the following is a feature of Azure Defender that provides vulnerability assessment for virtual machines?

Accepted Answer

Defender for Servers. Azure Defender includes integrated vulnerability assessment via Qualys or Microsoft built-in scanner, available for Defender for Servers.

Answer

Azure Secure Score

Answer

Azure Policy

Answer

Azure Sentinel