CCSP Cloud Security Operations Practice Test 2 — 15 Questions

Question 1

A security team needs to implement automated remediation for non-compliant resources in a cloud environment. They want to automatically fix public object storage bucket policies. Which combination of services should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configuration management service and serverless compute function. A configuration management service can evaluate resources against compliance rules. When a resource is non-compliant, the service can invoke a serverless compute function to perform automated remediation, such as making a public bucket private.

Answer

Audit logging service and serverless compute function

Answer

Threat detection service and workflow orchestration service

Answer

Security hub and vulnerability management service

Question 2

A cloud security architect is evaluating vulnerability management solutions for a hybrid cloud environment. The team needs to scan both on-premises servers and cloud workloads without installing agents on every system. Which approach is most suitable for cloud workloads?

Accepted Answer

Agentless scanning via cloud APIs (CSPM). Agentless scanning uses cloud APIs to assess vulnerabilities without requiring an agent on each instance. This is ideal for cloud workloads where agents may not be desired.

Answer

Agent-based scanning using a cloud-native service

Answer

Network vulnerability scanning from a remote scanner

Answer

Container image scanning only

Question 3

Which AWS service uses machine learning to detect threats such as crypto mining activity on EC2 instances and compromised IAM credentials?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify malicious activity.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Inspector

Question 4

An organization uses GCP and wants to monitor for threats in real-time, including detecting malicious activity from compromised service accounts. Which GCP service should be used?

Accepted Answer

Event Threat Detection. Event Threat Detection is part of GCP Security Command Center and provides real-time threat detection for IAM anomalies, including compromised service accounts.

Answer

Cloud Audit Logs

Answer

Cloud Security Scanner

Answer

Container Threat Detection

Question 5

A company uses Azure Defender for Cloud to protect its hybrid environment. Which of the following is a feature of Azure Defender that provides vulnerability assessment for virtual machines?

Accepted Answer

Defender for Servers. Azure Defender includes integrated vulnerability assessment via Qualys or Microsoft built-in scanner, available for Defender for Servers.

Answer

Azure Secure Score

Answer

Azure Policy

Answer

Azure Sentinel

Question 6

During incident response in a cloud environment, a team needs to collect evidence from a compromised EC2 instance without altering the system. Which of the following is the best method to obtain a forensic memory dump?

Accepted Answer

Use the AWS CLI to execute a memory dump script on the instance (e.g., via AWS Systems Manager Run Command). To obtain a forensic memory dump from a compromised EC2 instance without rebooting or altering the disk state, you can use the AWS CLI to invoke a command that runs a memory acquisition tool, such as LiME or AVML. For example, you could send a command via AWS Systems Manager Run Command to dump memory to an S3 bucket for analysis. Options A and D capture non-volatile disk states (AMI and EBS snapshot), and Option B is unrelated to evidence collection. Therefore, Option C is the best choice.

Answer

Create an AMI of the instance

Answer

Enable detailed billing reports

Answer

Take a snapshot of the root EBS volume

Question 7

An organization wants to implement a cloud security automation solution that can automatically remediate non-compliant resources in Azure. Which Azure service should be used to create remediation tasks?

Accepted Answer

Azure Policy. Azure Policy includes 'remediation tasks' that can automatically fix non-compliant resources, often using managed identities.

Answer

Azure Security Center

Answer

Azure Automation

Answer

Azure Logic Apps

Question 8

A security team is investigating a potential data exfiltration incident where a large volume of data was downloaded from a cloud storage bucket. Which log source would provide the most granular details about the GET requests, including the requester identity and source IP?

Accepted Answer

Cloud storage access logs. Cloud storage access logs provide detailed records of requests made to a bucket, including requester, source IP, and objects accessed. Cloud audit logs (data events) can also log storage operations, but storage access logs are more granular for this purpose.

Answer

VPC flow logs

Answer

Cloud management events (e.g., CloudTrail equivalent)

Answer

Log aggregation service for storage (e.g., CloudWatch equivalent)

Question 9

A security architect is designing a logging strategy for a multi-cloud environment using AWS and Azure. Which TWO practices should be implemented to ensure log integrity and prevent tampering? (Choose two.)

Accepted Answer

Enable CloudTrail log file validation. Log file validation (e.g., CloudTrail log file validation) ensures cryptographic verification of log integrity. Write-once-read-many (WORM) storage, such as S3 Object Lock or Azure Immutable Blob Storage, prevents deletion or modification of logs.

Answer

Store logs in a publicly readable S3 bucket for transparency

Answer

Encrypt logs using server-side encryption with AWS KMS

Answer

Enable cross-region replication for logs

Question 10

An organization is using GCP and wants to implement cloud security posture management (CSPM) to continuously monitor configurations against the CIS Benchmark. Which TWO GCP services can be used for this purpose? (Choose two.)

Accepted Answer

Cloud Asset Inventory. Cloud Asset Inventory provides a historical view of all GCP resources and their configurations, enabling continuous monitoring against compliance frameworks like the CIS Benchmark. Security Command Center offers built-in CSPM capabilities, including automated scanning for CIS Benchmark violations and actionable recommendations to remediate misconfigurations.

Answer

Cloud VPN

Answer

Cloud Audit Logs

Answer

Cloud Functions

Question 11

During a cloud incident response, the security team needs to eradicate a malicious Lambda function that was created by an attacker. Which THREE steps should be part of the eradication process? (Choose three.)

Accepted Answer

Delete the Lambda function. Deleting the Lambda function is a direct eradication step because it removes the attacker's malicious code from the AWS environment. Once deleted, the function can no longer be invoked, and any associated execution logs or metrics will cease. This action is irreversible and ensures the attacker's foothold is eliminated.

Answer

Disable CloudTrail logging in the affected region

Answer

Place the function in a quarantine VPC

Question 12

A security analyst is configuring Azure Defender for Cloud to protect a hybrid environment. Which THREE resource types can be protected by enabling Azure Defender plans? (Choose three.)

Accepted Answer

Azure SQL databases (Defender for Databases). Azure Defender for Cloud provides integrated security protections for Azure resources. Enabling the 'Defender for Databases' plan specifically protects Azure SQL databases by detecting anomalous activities, SQL injection attempts, and potential vulnerabilities. This plan extends to other database types like Azure SQL Managed Instance and Azure Synapse SQL pools, ensuring comprehensive database security.

Answer

Azure AD identities

Answer

Azure DNS zones

Question 13

During a security incident, the security team suspects that an attacker has tampered with the cloud audit logs to cover their tracks. Which feature would the team use to verify that the log files have not been modified since they were delivered?

Accepted Answer

Log file integrity validation. Log file integrity validation uses a cryptographic hash chain to create a digital signature for each log file, which is stored in a separate digest file. By computing the hash of a delivered log file and comparing it to the hash in the digest, the team can detect any tampering or modification after delivery. This feature is specifically designed to verify the integrity and authenticity of cloud audit logs.

Answer

Automated anomaly detection for audit logs

Answer

Storage access logs

Answer

Configuration compliance rules

Question 14

A security analyst is configuring a SIEM solution and wants to ingest security findings from a cloud provider's security findings service into Splunk. What is the most efficient method?

Accepted Answer

Use a serverless function to pull findings from the findings service API and push to Splunk HTTP Event Collector.. A serverless function can directly invoke the findings service API to retrieve findings and forward them to Splunk's HTTP Event Collector (HEC) in near real-time, avoiding intermediate storage or batch processing. This approach minimizes latency and operational overhead, making it the most efficient method for continuous ingestion.

Answer

Enable cross-region aggregation of findings, then export to a CSV file.

Answer

Configure the findings service to publish findings to a cloud storage bucket, then use Splunk to read from the bucket.

Answer

Use a data catalog service to catalog findings data and connect to Splunk via JDBC.

Question 15

A cloud security team implements correlation rules in their SIEM to detect 'impossible travel' scenarios. Which combination of log sources is essential for detecting a user logging in from two different countries within a short time frame?

Accepted Answer

CloudTrail management events and AWS CloudTrail authentication events. Detecting impossible travel requires authentication logs (who logged in and from where) and timestamps. Cloud provider authentication logs (e.g., AWS CloudTrail for console logins, Azure AD sign-in logs) provide the necessary data.

Answer

Amazon GuardDuty findings and Security Hub

Answer

AWS Config history and resource inventory

Answer

VPC Flow Logs and DNS logs