CCSP Cloud Security Operations — 40 Questions

Question 1

An organization is setting up a centralized logging solution across multiple accounts in their cloud environment. The security team requires that logs from all accounts be sent to a single security account, with lifecycle policies to transition logs to cheaper storage after 90 days. Which approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the cloud provider's organizational structure and enable a single audit logging configuration that delivers logs to a central storage container in the management account.. Using the cloud provider's organizational structure and enabling a single audit logging configuration that delivers logs to a central storage container in the management account is the most efficient and centralized approach. This leverages native organizational trails or equivalent features to aggregate logs across accounts, and lifecycle policies can be applied to the central bucket for cost optimization.

Answer

Enable the cloud provider's native audit logging in each account and manually copy logs daily to the security account.

Answer

Create an audit log configuration in each account and export logs to a centralized monitoring service, then use cross-account log forwarding to a central storage container.

Answer

Use a serverless function to copy logs from each account's storage container to the central storage container.

Question 2

During a cloud security incident, a security team needs to isolate a compromised virtual machine instance that is performing outbound port scanning. Which containment action should be taken first?

Accepted Answer

Modify the security group to deny outbound traffic. Modifying the virtual machine's security group rules to deny all outbound traffic is a quick and reversible containment action that stops the scanning.

Answer

Terminate the virtual machine instance immediately

Answer

Create a snapshot or image of the virtual machine for analysis

Answer

Detach the virtual machine from the virtual network

Question 3

A cloud security analyst is configuring a SIEM correlation rule to detect mass data exfiltration from an AWS S3 bucket. Which THREE log sources should be ingested to create an effective detection? (Choose three.)

Accepted Answer

CloudTrail data events for S3. CloudTrail data events for S3 (B) are essential because they record object-level API operations such as GetObject and PutObject on S3 buckets, which directly reveal mass download or exfiltration activity that management events do not capture. S3 server access logs (D) provide detailed per-request records including requester IP, request URI, and bytes sent, enabling detection of anomalous large-volume transfers from the bucket. VPC Flow Logs (C) capture network-level metadata for traffic to and from the VPC, helping correlate the volume and destination of data leaving the environment, which strengthens the exfiltration detection. AWS Config configuration history (A) only tracks resource configuration changes and does not record data access, so it cannot detect exfiltration. CloudTrail management events (E) log control-plane actions like bucket policy changes but not object-level reads/writes, so they miss the actual data transfer activity.

Answer

AWS Config configuration history

Answer

CloudTrail management events

Question 4

An organization is using GCP and wants to implement cloud security posture management (CSPM) to continuously monitor configurations against the CIS Benchmark. Which TWO GCP services can be used for this purpose? (Choose two.)

Accepted Answer

Cloud Asset Inventory. Security Command Center (C) is GCP's native security posture management service and includes the Security Health Analytics built-in detector, which continuously scans resources against CIS Benchmark controls and other standards, surfacing misconfigurations as findings. Cloud Asset Inventory (B) supports CSPM by exporting and monitoring resource metadata and configuration history, and it can feed organization-level policies and analysis (e.g., via asset feeds and exports to BigQuery) to continuously evaluate configurations against CIS controls. Cloud Audit Logs (D) only record API activity and administrative events; they provide an audit trail rather than a configuration-against-benchmark evaluation engine. Cloud VPN (A) is a networking service for encrypted tunnels and has no posture-management capability, and Cloud Functions (E) is a serverless compute runtime that could be used to build custom checks but is not itself a CSPM service.

Answer

Cloud VPN

Answer

Cloud Audit Logs

Answer

Cloud Functions

Question 5

During a cloud incident response, the security team needs to eradicate a malicious Lambda function that was created by an attacker. Which THREE steps should be part of the eradication process? (Choose three.)

Accepted Answer

Delete the Lambda function. Option A (Delete the Lambda function) is correct because removing the malicious function itself is the core eradication action that stops the attacker's code from executing and eliminates the artifact from the environment. Option B (Review and remove any CloudWatch Events triggers) is correct because EventBridge/CloudWatch Events rules can invoke the Lambda on a schedule or in response to events, so leaving triggers in place could re-invoke the function or allow the attacker to re-establish execution; the triggers must be identified and removed. Option C (Revoke any IAM roles associated with the function) is correct because the Lambda's execution role may have been granted excessive permissions or used to pivot to other AWS services, so the role's permissions/policies must be revoked or the role deleted to cut off the attacker's access path. Option D is not part of eradication because disabling CloudTrail logging would destroy forensic evidence and hinder the investigation rather than remove the threat. Option E is not appropriate here because quarantining via a VPC is a containment technique for network-isolating resources, not an eradication step for a Lambda function that should simply be deleted along with its triggers and associated role.

Answer

Disable CloudTrail logging in the affected region

Answer

Place the function in a quarantine VPC

Question 6

A security analyst is configuring Azure Defender for Cloud to protect a hybrid environment. Which THREE resource types can be protected by enabling Azure Defender plans? (Choose three.)

Accepted Answer

Azure SQL databases (Defender for Databases). Option A is correct because Azure Defender for Databases (Defender for SQL) is a valid Defender plan that protects Azure SQL databases, including Azure SQL Database, Azure SQL Managed Instance, and SQL Server on Azure VMs, by detecting anomalous access patterns, potential SQL injection, and suspicious database activities. Option B is correct because Defender for Key Vault is a legitimate Defender for Cloud plan that monitors Azure Key Vault access and operations to detect unusual or potentially harmful attempts to access or exploit key vaults. Option D is correct because Defender for Servers is a core Defender for Cloud plan that protects Windows and Linux virtual machines in Azure, on-premises, and other clouds by providing vulnerability assessment, file integrity monitoring, and just-in-time VM access. Option C is not correct because Microsoft Entra ID identities are protected by Microsoft Defender for Identity (and Microsoft Entra ID Protection), not by a Defender for Cloud plan enabled at the subscription level. Option E is not correct because Azure DNS zones are not a protected resource type under Azure Defender plans; DNS-related threats are addressed through other services such as Azure Firewall, DNS security features, or Microsoft Defender for DNS (which is part of Defender for Servers/containers scenarios rather than a standalone DNS zones plan).

Answer

Azure AD identities

Answer

Azure DNS zones

Question 7

During a security incident, the security team suspects that an attacker has tampered with the cloud audit logs to cover their tracks. Which feature would the team use to verify that the log files have not been modified since they were delivered?

Accepted Answer

Log file integrity validation. Log file integrity validation uses a cryptographic hash chain to create a digital signature for each log file, which is stored in a separate digest file. By computing the hash of a delivered log file and comparing it to the hash in the digest, the team can detect any tampering or modification after delivery. This feature is specifically designed to verify the integrity and authenticity of cloud audit logs.

Answer

Automated anomaly detection for audit logs

Answer

Storage access logs

Answer

Configuration compliance rules

Question 8

A security analyst is configuring a SIEM solution and wants to ingest security findings from a cloud provider's security findings service into Splunk. What is the most efficient method?

Accepted Answer

Use a serverless function to pull findings from the findings service API and push to Splunk HTTP Event Collector.. A serverless function can directly invoke the findings service API to retrieve findings and forward them to Splunk's HTTP Event Collector (HEC) in near real-time, avoiding intermediate storage or batch processing. This approach minimizes latency and operational overhead, making it the most efficient method for continuous ingestion.

Answer

Enable cross-region aggregation of findings, then export to a CSV file.

Answer

Configure the findings service to publish findings to a cloud storage bucket, then use Splunk to read from the bucket.

Answer

Use a data catalog service to catalog findings data and connect to Splunk via JDBC.

Question 9

A cloud security team implements correlation rules in their SIEM to detect 'impossible travel' scenarios. Which combination of log sources is essential for detecting a user logging in from two different countries within a short time frame?

Accepted Answer

CloudTrail management events and AWS CloudTrail authentication events. Detecting 'impossible travel' requires correlating authentication events that include user identity, source IP, and timestamp. CloudTrail management events capture API activity including console sign-in events, and CloudTrail authentication events (or sign-in events) provide detailed login information such as source IP and user agent. Together, they allow the SIEM to identify a user logging in from two different countries within a short time frame.

Answer

Amazon GuardDuty findings and Security Hub

Answer

AWS Config history and resource inventory

Answer

VPC Flow Logs and DNS logs

Question 10

During a cloud security incident, the incident response team needs to contain a compromised cloud instance. Which action should be taken FIRST to prevent further malicious activity while preserving evidence?

Accepted Answer

Modify the network security rule associated with the instance to deny all traffic.. Modifying the network security rule to deny all traffic immediately isolates the compromised cloud instance, preventing further malicious network activity while preserving the instance's state for forensic analysis. This containment step is reversible and does not destroy volatile data or system processes, unlike termination or snapshot creation, which can alter evidence.

Answer

Revoke the role associated with the instance.

Answer

Create a snapshot of the instance volume for forensic analysis.

Answer

Terminate the instance immediately.

Question 11

A security team is investigating a potential credential compromise in a cloud environment. They have cloud audit logs showing a user's access key was used to provision compute instances in a geographic region where the user has never operated. What is the BEST course of action to confirm and contain the incident?

Accepted Answer

Check cloud audit logs for the access key events, then rotate the access key.. The first step in confirming a potential credential compromise is to verify that the anomalous activity (instance launches in an unfamiliar region) is indeed associated with the specific access key in the audit logs. Once confirmed, rotating the key (i.e., deactivating the old key and issuing a new one) immediately invalidates the compromised credential, stopping any further unauthorized use while preserving the user's ability to operate with a new key. This aligns with cloud security incident response best practices for credential compromise.

Answer

Create a new access policy to deny all actions for that user.

Answer

Immediately delete all compute instances launched by that user.

Answer

Disable the user's console access and delete the access key.

Question 12

A cloud security team is designing an incident response playbook for a suspected data exfiltration via an AWS S3 bucket. Which TWO actions should be included for containment and evidence collection? (Choose two.)

Accepted Answer

Revoke IAM credentials associated with the compromised access.. Option B is correct because revoking the IAM credentials (for example, by deactivating the access key or attaching a deny policy) immediately cuts off the attacker's authenticated access to the S3 bucket, which is the primary containment step for a credential-based exfiltration. Option D is correct because enabling VPC Flow Logs captures IP-level metadata for traffic to and from the VPC where the bucket is accessed, providing network evidence that supports the investigation and helps identify the exfiltration source and destination. Option A is not appropriate because mass password changes are a broad, disruptive action not tied to the specific compromised S3 access and would not contain the incident. Option C is not appropriate because AWS Backup snapshots are for backup and recovery, not for preserving S3 object evidence, and S3 versioning or object lock would be the relevant evidence-preservation mechanisms. Option E is not appropriate because deleting the bucket destroys evidence and is not a valid containment action.

Answer

Immediately notify all users to change passwords.

Answer

Take a snapshot of the S3 bucket using AWS Backup.

Answer

Delete the S3 bucket to prevent further access.

Question 13

A company uses GCP and wants to implement agentless vulnerability scanning for their Compute Engine instances. Which TWO services can provide this capability? (Choose two.)

Accepted Answer

Rapid7 InsightVM (agentless via API). Option D, GCP Security Command Center, is correct because its built-in Web Security Scanner and, more importantly, its integration with vulnerability detection (via Security Health Analytics and the Premium/Enterprise tiers) can surface OS and software vulnerabilities on Compute Engine instances without installing agents, using the metadata and API-based scanning of the underlying infrastructure. Option C, Rapid7 InsightVM (agentless via API), is correct because InsightVM supports agentless scanning of cloud instances by authenticating to the target over SSH/WinRM or by using cloud APIs to enumerate and assess vulnerabilities remotely, which fits the agentless requirement for GCP Compute Engine. Option A, GCP Web Security Scanner, is not correct here because it only scans web applications (App Engine, Compute Engine, GKE) for common web vulnerabilities like XSS and mixed content, not OS-level or package vulnerabilities on instances. Option B, GCP Cloud Armor, is not correct because it is a WAF/DDoS protection service that filters HTTP(S) traffic at the edge and does not perform vulnerability scanning. Option E, Qualys Cloud Agent, is not correct because it is an installed agent on the host, which contradicts the agentless requirement.

Answer

GCP Web Security Scanner

Answer

GCP Cloud Armor

Answer

Qualys Cloud Agent

Question 14

An organization is implementing a SOAR solution for cloud incident response. Which THREE capabilities are essential for automating incident response workflows? (Choose three.)

Accepted Answer

Integration with threat intelligence feeds. Option A (Integration with threat intelligence feeds) is correct because SOAR automation depends on enriched indicators (IPs, domains, hashes, TTPs mapped to MITRE ATT&CK) to make automated triage and decision logic context-aware rather than acting on raw alerts alone. Option B (Automated playbook execution) is correct because playbooks are the core orchestration mechanism that triggers and sequences response actions—such as isolating an EC2 instance, revoking IAM credentials, or blocking an IP—without human intervention. Option C (Case management and reporting) is correct because SOAR platforms must track incidents through their lifecycle, correlate related alerts into a single case, and produce audit-ready metrics and post-incident reports for compliance and continuous improvement. Option D (Manual ticketing system) does not belong because manual, human-driven ticketing is the antithesis of automation and lacks the orchestration and machine-speed execution SOAR requires. Option E (Real-time user activity monitoring) does not belong because UEBA/activity monitoring is a detection and visibility capability, not an essential automation component of a SOAR workflow.

Answer

Manual ticketing system

Answer

Real-time user activity monitoring

Question 15

A security team is configuring AWS CloudTrail to enable detection of unauthorized API calls. They want to ensure that log files cannot be tampered with after delivery. Which CloudTrail feature should they enable?

Accepted Answer

CloudTrail Log File Validation. CloudTrail Log File Validation (option B) uses a SHA-256 hash chain to create a digital signature for each log file, enabling integrity verification. When enabled, CloudTrail delivers digest files that contain hashes of log files, allowing you to confirm that log files were not modified, deleted, or tampered with after delivery. This directly addresses the requirement to detect unauthorized API calls by ensuring the logs themselves are trustworthy.

Answer

CloudTrail Insights

Answer

CloudTrail Multi-Region Trail

Answer

CloudTrail Event History

Question 16

During a cloud security incident, the response team needs to collect evidence from a compromised AWS EC2 instance. Which method is most appropriate for capturing volatile data while preserving forensic integrity?

Accepted Answer

Create a memory dump by SSH and save to S3. The most appropriate method for capturing volatile data (memory) from a compromised EC2 instance. Using SSH to perform a memory dump (e.g., via LiME or fmem) and saving the output to S3 captures RAM contents, which is volatile and critical for incident response. While SSH access alters system state, it is the standard approach for remote memory acquisition when direct physical access is unavailable. Option C (EBS snapshot) captures persistent storage, not volatile memory, so it is incorrect for the stated requirement.

Answer

Terminate the instance and launch a replacement

Answer

Take an EBS snapshot of the instance's volumes

Answer

Reboot the instance and collect logs

Question 17

A cloud security engineer needs to implement a solution to detect configuration drift against CIS benchmarks for AWS workloads. Which tool or service is specifically designed for cloud security posture management (CSPM) in AWS?

Accepted Answer

AWS Security Hub. AWS Security Hub is a cloud security posture management (CSPM) service that aggregates security findings from multiple AWS services and third-party tools, and it can continuously monitor AWS workloads against CIS AWS Foundations Benchmarks. It provides automated compliance checks, consolidated dashboards, and remediation guidance specifically designed for detecting configuration drift from benchmark standards.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Inspector

Question 18

A security team is implementing vulnerability management in a hybrid cloud environment. They need to scan virtual machines without installing an agent. Which approach is most suitable?

Accepted Answer

Agentless scanning using cloud APIs. Agentless scanning using cloud APIs (Option B) is the correct approach because it allows the security team to scan virtual machines without installing any software on the VMs themselves. This method leverages cloud provider APIs (e.g., AWS EC2 DescribeInstances, Azure VM REST APIs) to query the hypervisor or management plane for VM configurations, patch levels, and vulnerabilities, making it ideal for hybrid cloud environments where agent deployment may be impractical or restricted.

Answer

Deploying a third-party vulnerability scanner on each VM

Answer

Agent-based scanning with AWS Inspector

Answer

Using container image scanning in registry

Question 19

A cloud security architect is designing a log aggregation strategy for a multi-account AWS environment. The security team needs to ensure logs from all accounts are stored centrally and cannot be altered. Which combination of services meets these requirements?

Accepted Answer

CloudTrail with cross-account log delivery to a central S3 bucket and enable log file validation. AWS CloudTrail supports cross-account log delivery to a central S3 bucket, and enabling log file validation uses a digest file signed with the CloudTrail private key to cryptographically verify that log files have not been modified, deleted, or tampered with since delivery. This combination ensures centralized storage and immutability, meeting the security team's requirements.

Answer

CloudWatch Logs to a centralized log group with IAM policies

Answer

S3 server access logs delivered to each account's own bucket

Answer

VPC Flow Logs to CloudWatch Logs in each account

Question 20

A cloud security analyst is investigating a potential credential compromise in AWS. Which TWO CloudTrail events would be most relevant to establishing a timeline of the compromise?

Accepted Answer

CreateAccessKey. ConsoleLogin (E) is correct because it records successful and failed AWS Management Console authentication events, including the IAM user, source IP, MFA usage, and timestamp, which directly anchors when an attacker first gained interactive access. CreateAccessKey (C) is correct because it logs the creation of long-term IAM access key credentials, a common persistence technique after a compromise, and its event time helps establish when the attacker established programmatic access. Together these two events bracket the credential compromise timeline from initial console login to key creation. DeleteBucket (A) is a destructive S3 action that may occur later but does not itself establish credential compromise timing, UpdateLoginProfile (B) changes a password policy/profile and is not a reliable initial-access indicator, and DescribeInstances (D) is a routine read-only EC2 call that is too noisy and non-specific to anchor a compromise timeline.

Answer

DeleteBucket

Answer

UpdateLoginProfile

Answer

DescribeInstances