CCSP Cloud Security Operations Practice Test 2 — 15 Questions

Question 1

During a cloud security incident, the response team needs to collect evidence from a compromised AWS EC2 instance. Which method is most appropriate for capturing volatile data while preserving forensic integrity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a memory dump by SSH and save to S3. The most appropriate method for capturing volatile data (memory) from a compromised EC2 instance. Using SSH to perform a memory dump (e.g., via LiME or fmem) and saving the output to S3 captures RAM contents, which is volatile and critical for incident response. While SSH access alters system state, it is the standard approach for remote memory acquisition when direct physical access is unavailable. Option C (EBS snapshot) captures persistent storage, not volatile memory, so it is incorrect for the stated requirement.

Answer

Terminate the instance and launch a replacement

Answer

Take an EBS snapshot of the instance's volumes

Answer

Reboot the instance and collect logs

Question 2

A cloud security engineer needs to implement a solution to detect configuration drift against CIS benchmarks for AWS workloads. Which tool or service is specifically designed for cloud security posture management (CSPM) in AWS?

Accepted Answer

AWS Security Hub. AWS Security Hub is a cloud security posture management (CSPM) service that aggregates security findings from multiple AWS services and third-party tools, and it can continuously monitor AWS workloads against CIS AWS Foundations Benchmarks. It provides automated compliance checks, consolidated dashboards, and remediation guidance specifically designed for detecting configuration drift from benchmark standards.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Inspector

Question 3

A security team is implementing vulnerability management in a hybrid cloud environment. They need to scan virtual machines without installing an agent. Which approach is most suitable?

Accepted Answer

Agentless scanning using cloud APIs. Agentless scanning using cloud APIs (Option B) is the correct approach because it allows the security team to scan virtual machines without installing any software on the VMs themselves. This method leverages cloud provider APIs (e.g., AWS EC2 DescribeInstances, Azure VM REST APIs) to query the hypervisor or management plane for VM configurations, patch levels, and vulnerabilities, making it ideal for hybrid cloud environments where agent deployment may be impractical or restricted.

Answer

Deploying a third-party vulnerability scanner on each VM

Answer

Agent-based scanning with AWS Inspector

Answer

Using container image scanning in registry

Question 4

A cloud security architect is designing a log aggregation strategy for a multi-account AWS environment. The security team needs to ensure logs from all accounts are stored centrally and cannot be altered. Which combination of services meets these requirements?

Accepted Answer

CloudTrail with cross-account log delivery to a central S3 bucket and enable log file validation. AWS CloudTrail supports cross-account log delivery to a central S3 bucket, and enabling log file validation uses a digest file signed with the CloudTrail private key to cryptographically verify that log files have not been modified, deleted, or tampered with since delivery. This combination ensures centralized storage and immutability, meeting the security team's requirements.

Answer

CloudWatch Logs to a centralized log group with IAM policies

Answer

S3 server access logs delivered to each account's own bucket

Answer

VPC Flow Logs to CloudWatch Logs in each account

Question 5

A cloud security analyst is investigating a potential credential compromise in AWS. Which TWO CloudTrail events would be most relevant to establishing a timeline of the compromise?

Accepted Answer

CreateAccessKey. ConsoleLogin (E) is correct because it records successful and failed AWS Management Console authentication events, including the IAM user, source IP, MFA usage, and timestamp, which directly anchors when an attacker first gained interactive access. CreateAccessKey (C) is correct because it logs the creation of long-term IAM access key credentials, a common persistence technique after a compromise, and its event time helps establish when the attacker established programmatic access. Together these two events bracket the credential compromise timeline from initial console login to key creation. DeleteBucket (A) is a destructive S3 action that may occur later but does not itself establish credential compromise timing, UpdateLoginProfile (B) changes a password policy/profile and is not a reliable initial-access indicator, and DescribeInstances (D) is a routine read-only EC2 call that is too noisy and non-specific to anchor a compromise timeline.

Answer

DeleteBucket

Answer

UpdateLoginProfile

Answer

DescribeInstances

Question 6

An organization is implementing automated remediation for common cloud security misconfigurations using AWS Config and Lambda. Which THREE misconfigurations can be automatically remediated using this approach?

Accepted Answer

S3 bucket with public read access. Option A is correct because AWS Config can detect an S3 bucket with public read access via the s3-bucket-public-read-prohibited managed rule, and a Lambda remediation function can then apply a bucket policy or enable Block Public Access to remove the exposure. Option B is correct because the encrypted-volumes Config rule flags EBS volumes that are unencrypted, and Lambda can remediate by creating an encrypted snapshot/copy or by enforcing encryption through the account-level EBS encryption default. Option E is correct because Config's restricted-ssh rule identifies security groups allowing SSH (port 22) from 0.0.0.0/0, and Lambda can revoke the offending ingress rule or replace it with a scoped CIDR. Option C is not a security misconfiguration that Config/Lambda remediation typically targets, since instance type compliance is a cost/governance concern rather than a remediable security finding. Option D is not directly remediable in the same way because the default security group's permissive rules are often required for VPC functionality and Config does not provide a standard managed rule that auto-remediates it as described.

Answer

EC2 instance type not compliant with corporate standard

Answer

VPC with default security group allowing all traffic

Question 7

A company is deploying a SIEM solution in Azure. Which THREE data sources should be ingested to provide comprehensive visibility into the cloud environment?

Accepted Answer

Azure Activity Logs. Azure Activity Logs (A) are correct because they record subscription-level control-plane operations such as resource creation, deletion, and role assignments, giving the SIEM visibility into administrative changes across the environment. Microsoft Entra ID sign-in logs (B) are correct because they capture authentication events, including interactive and non-interactive sign-ins, conditional access results, and risk detections, which are essential for detecting identity-based attacks. Azure Defender for Cloud alerts (E) are correct because they surface security alerts and findings from workload protection and posture management, providing the SIEM with actionable threat detections. Azure VNet Flow Logs (C) are not marked correct because, while useful for network traffic analysis, they are not among the three sources specified for this scenario's comprehensive cloud visibility. Azure Monitor Metrics (D) are not marked correct because they provide numeric performance telemetry rather than the security-relevant event and alert data needed for SIEM correlation.

Answer

Azure VNet Flow Logs

Answer

Azure Monitor Metrics

Question 8

A company uses Azure and wants to ensure that all activity log events are retained for seven years to meet compliance requirements. What is the most efficient way to implement this?

Accepted Answer

Export activity logs to an Azure Storage account and apply a lifecycle management policy to delete logs after 7 years.. Exporting activity logs to an Azure Storage account and applying a lifecycle management policy is the most efficient and cost-effective approach because Azure Storage is designed for long-term archival at low cost, and lifecycle management policies can automatically transition blobs to cooler tiers and delete them after exactly 7 years. This avoids the higher ingestion and retention costs of Log Analytics while meeting the 7-year compliance requirement.

Answer

Enable Azure Monitor and configure the activity log to be stored in a Log Analytics workspace with a retention of 7 years.

Answer

Use Azure Backup to back up activity logs and retain them for 7 years.

Answer

Configure activity logs to be sent to an Event Hub and then to a third-party archival service.

Question 9

A cloud security team wants to automatically detect and remediate S3 buckets that are publicly accessible. Which combination of AWS services can achieve this?

Accepted Answer

AWS Config and AWS Lambda. AWS Config continuously evaluates S3 bucket configurations against rules (e.g., s3-bucket-public-read-prohibited) and can trigger an AWS Lambda function via Amazon EventBridge when a non-compliant change is detected. The Lambda function then automatically applies a remediation action, such as removing the public access block or updating the bucket policy, achieving automated detection and remediation without manual intervention.

Answer

Amazon Inspector and AWS Security Hub

Answer

AWS WAF and Amazon Route 53

Answer

AWS CloudTrail and Amazon GuardDuty

Question 10

A security team wants to detect when the root user account is used in a cloud environment. Which service can generate an alert for this activity?

Accepted Answer

Threat detection service. A threat detection service is designed to continuously monitor for malicious or unauthorized behavior, including the use of the root user account. It uses machine learning and integrated threat intelligence to generate findings for such activities, which can then trigger alerts via event notification services. This makes it the correct choice for detecting root user usage.

Answer

Activity logging service

Answer

Configuration monitoring service

Answer

Security posture management service

Question 11

An organization is designing an incident response playbook for a compromised AWS IAM user. Which THREE actions should be included in the containment phase? (Choose three.)

Accepted Answer

Disable the user's access keys.. Option A is correct because disabling the compromised IAM user's access keys (via UpdateAccessKey with status Inactive) immediately prevents the attacker from using those long-term credentials to make further AWS API calls. Option C is correct because attaching an explicit deny-all IAM policy (or an AWS Organizations SCP) to the user overrides any existing allow policies and blocks all actions, providing a strong containment control even if other credentials remain. Option E is correct because revoking the user's IAM credentials—deleting access keys, deactivating passwords, and removing permissions—eliminates the identity's ability to authenticate and act, which is a core containment step for a compromised principal. Option B does not belong because snapshotting EC2 instances is a forensic evidence-preservation activity, not containment, and it does not stop the attacker. Option D does not belong because terminating EC2 instances is a destructive action that can destroy forensic evidence and is not a standard containment step for a compromised IAM user.

Answer

Take a snapshot of all EC2 instances for forensic analysis.

Answer

Terminate any EC2 instances launched by the user.

Question 12

A company is using Azure and wants to implement cloud security posture management (CSPM) to detect misconfigurations. Which TWO services can provide CSPM capabilities? (Choose two.)

Accepted Answer

Azure Policy. Azure Policy (B) is correct because it evaluates Azure resources against built-in or custom policy definitions and provides compliance assessments that surface misconfigurations, which is a core CSPM capability. Microsoft Defender for Cloud (E) is correct because its foundational CSPM features continuously assess Azure, AWS, GCP, and on-premises resources against security benchmarks like Microsoft Cloud Security Benchmark and CIS, producing secure score and misconfiguration findings. Azure Key Vault (A) is a secrets, keys, and certificate management service, not a posture assessment tool. Azure Monitor (C) collects metrics, logs, and alerts for observability but does not itself evaluate configuration compliance. Azure Sentinel (D) is a SIEM/SOAR platform for threat detection and incident response, not CSPM misconfiguration assessment.

Answer

Azure Key Vault

Answer

Azure Monitor

Answer

Azure Sentinel

Question 13

An organization is using GCP and wants to implement automated remediation of security misconfigurations. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

Cloud Functions. Cloud Security Command Center (E) is correct because it continuously detects security misconfigurations and vulnerabilities across GCP assets, and it can publish findings to Pub/Sub so that automated remediation workflows are triggered. Cloud Functions (D) is correct because it can subscribe to those Pub/Sub notifications and execute remediation code, such as disabling a public bucket or revoking an overly permissive IAM binding, without managing servers. Together, Security Command Center detects the misconfiguration and Cloud Functions performs the automated fix. Cloud Build (A) is a CI/CD service for building and deploying artifacts, not a misconfiguration detection or event-driven remediation engine. Cloud Audit Logs (B) records administrative and data access activity but does not itself identify misconfigurations or perform remediation. Cloud Storage (C) is object storage and plays no role in detecting or remediating security misconfigurations.

Answer

Cloud Build

Answer

Cloud Audit Logs

Answer

Cloud Storage

Question 14

A company uses AWS CloudTrail with log file validation enabled. An auditor wants to verify that a specific log file has not been tampered with. Which process should the auditor use to confirm the integrity of the CloudTrail log file?

Accepted Answer

Use the AWS CLI command 'aws cloudtrail validate-logs' which automatically verifies the digital signature and hash. CloudTrail log file validation uses SHA-256 hashing and digital signatures. The log file digest file contains the hash of the log file and is signed by a private key. To verify, the auditor uses the public key (from AWS) to verify the signature on the digest, then compares the hash of the log file to the hash in the digest.

Answer

Check the log file’s last modified timestamp against the CloudTrail delivery timestamp

Answer

Compare the log file’s SHA-256 hash with the hash stored in AWS Key Management Service (KMS)

Answer

Review the log file’s integrity using the SHA-256 checksum provided in the S3 object metadata

Question 15

A security analyst notices a spike in failed login attempts from an IP address in a country where the company has no operations. Which SIEM correlation rule would be most effective in detecting this type of activity?

Accepted Answer

Mass S3 download – high volume of GetObject requests from a single IP. A mass S3 download rule detects a high volume of GetObject requests from a single IP, which aligns with the scenario of a spike in failed login attempts from a single IP. While the rule is designed for data exfiltration, it can be adapted to detect any anomalous high-volume activity from a single source, making it the most effective among the given options. Impossible travel (B) requires successful logins from distant locations, not failed attempts, and the other options address different threats.

Answer

Root account usage – alert when root user performs any action

Answer

Impossible travel – login from two geographically distant locations within minutes

Answer

New IAM admin user creation – detection of privileged role assignment