CCSP Cloud Security Operations Practice Test 2 — 15 Questions

Question 1

A security architect is designing a logging strategy for a multi-cloud environment using AWS and Azure. Which TWO practices should be implemented to ensure log integrity and prevent tampering? (Choose two.)

Accepted Answer

Enable CloudTrail log file validation. Log file validation (e.g., CloudTrail log file validation) ensures cryptographic verification of log integrity. Write-once-read-many (WORM) storage, such as S3 Object Lock or Azure Immutable Blob Storage, prevents deletion or modification of logs.

Answer

Store logs in a publicly readable S3 bucket for transparency

Answer

Encrypt logs using server-side encryption with AWS KMS

Answer

Enable cross-region replication for logs

Question 2

A cloud security analyst is configuring a SIEM correlation rule to detect mass data exfiltration from an AWS S3 bucket. Which THREE log sources should be ingested to create an effective detection? (Choose three.)

Accepted Answer

CloudTrail data events for S3. CloudTrail data events for S3 capture object-level API operations such as GetObject, PutObject, and DeleteObject. By monitoring these events, a SIEM can detect anomalous patterns like a sudden spike in read requests from a single IP, which is a strong indicator of mass data exfiltration. This log source provides the granularity needed to identify the specific actions and actors involved in data access.

Answer

AWS Config configuration history

Answer

CloudTrail management events

Question 3

A security engineer is implementing automated incident response for common cloud threats. Which TWO AWS services can be used together to create a serverless orchestration workflow for incident response? (Choose two.)

Accepted Answer

AWS Step Functions. AWS Step Functions can orchestrate multi-step workflows, and AWS Lambda can execute the remediation actions. Together they form a serverless incident response pipeline.

Answer

AWS CloudFormation

Answer

Amazon EC2

Answer

Amazon Inspector

Question 4

An organization is using GCP and wants to implement cloud security posture management (CSPM) to continuously monitor configurations against the CIS Benchmark. Which TWO GCP services can be used for this purpose? (Choose two.)

Accepted Answer

Cloud Asset Inventory. Cloud Asset Inventory provides a historical view of all GCP resources and their configurations, enabling continuous monitoring against compliance frameworks like the CIS Benchmark. Security Command Center offers built-in CSPM capabilities, including automated scanning for CIS Benchmark violations and actionable recommendations to remediate misconfigurations.

Answer

Cloud VPN

Answer

Cloud Audit Logs

Answer

Cloud Functions

Question 5

During a cloud incident response, the security team needs to eradicate a malicious Lambda function that was created by an attacker. Which THREE steps should be part of the eradication process? (Choose three.)

Accepted Answer

Delete the Lambda function. Deleting the Lambda function is a direct eradication step because it removes the attacker's malicious code from the AWS environment. Once deleted, the function can no longer be invoked, and any associated execution logs or metrics will cease. This action is irreversible and ensures the attacker's foothold is eliminated.

Answer

Disable CloudTrail logging in the affected region

Answer

Place the function in a quarantine VPC

Question 6

A security analyst is configuring Azure Defender for Cloud to protect a hybrid environment. Which THREE resource types can be protected by enabling Azure Defender plans? (Choose three.)

Accepted Answer

Azure SQL databases (Defender for Databases). Azure Defender for Cloud provides integrated security protections for Azure resources. Enabling the 'Defender for Databases' plan specifically protects Azure SQL databases by detecting anomalous activities, SQL injection attempts, and potential vulnerabilities. This plan extends to other database types like Azure SQL Managed Instance and Azure Synapse SQL pools, ensuring comprehensive database security.

Answer

Azure AD identities

Answer

Azure DNS zones

Question 7

A security engineer needs to ensure that all API calls made to AWS resources are logged for auditing purposes. Which AWS service should be enabled to capture management events, data events, and provide log file validation?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to log API calls and actions taken within an AWS account, capturing management events (e.g., creating or deleting resources) and data events (e.g., S3 object-level operations). It also provides log file validation through digital signatures using SHA-256 hashing and RSA, ensuring the integrity and authenticity of the log files after they have been delivered.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS GuardDuty

Question 8

An organization is using Azure and wants to centrally collect activity logs from multiple subscriptions into a single Log Analytics workspace for cross-account analysis and retention management. What is the best approach?

Accepted Answer

Use Azure Policy to deploy Diagnostic Settings on each subscription to stream Activity Logs to a central Log Analytics workspace.. Option C is correct because Azure Policy can enforce the deployment of Diagnostic Settings across all subscriptions, automatically streaming Activity Logs to a central Log Analytics workspace. This ensures centralized collection, cross-account analysis, and retention management without manual configuration per subscription.

Answer

Use Azure Monitor Agent on all VMs to collect logs.

Answer

Enable Azure Sentinel on each subscription and aggregate using cross-workspace queries.

Answer

Use Azure Storage account with event grid to forward logs to a central location.

Question 9

During a security incident in AWS, the security team suspects that an attacker has tampered with CloudTrail logs to cover their tracks. Which CloudTrail feature would the team use to verify that the log files have not been modified since they were delivered?

Accepted Answer

CloudTrail log file validation. CloudTrail log file validation uses a SHA-256 hash chain to create a digital signature for each log file, which is stored in a separate digest file. By computing the hash of a delivered log file and comparing it to the hash in the digest, the team can detect any tampering or modification after delivery. This feature is specifically designed to verify the integrity and authenticity of CloudTrail logs.

Answer

CloudTrail Insights

Answer

S3 server access logs

Answer

AWS Config rules

Question 10

A security analyst is configuring a SIEM solution and wants to ingest security findings from AWS Security Hub into Splunk. What is the most efficient method?

Accepted Answer

Use AWS Lambda to pull findings from Security Hub API and push to Splunk HTTP Event Collector.. Option B is correct because AWS Lambda can directly invoke the Security Hub API to retrieve findings and forward them to Splunk's HTTP Event Collector (HEC) in near real-time, avoiding intermediate storage or batch processing. This serverless approach minimizes latency and operational overhead, making it the most efficient method for continuous ingestion.

Answer

Enable Security Hub cross-Region aggregation, then export to a CSV file.

Answer

Configure Security Hub to publish findings to an S3 bucket, then use Splunk to read from S3.

Answer

Use AWS Glue to catalog Security Hub data and connect to Splunk via JDBC.

Question 11

A cloud security team implements correlation rules in their SIEM to detect 'impossible travel' scenarios. Which combination of log sources is essential for detecting a user logging in from two different countries within a short time frame?

Accepted Answer

CloudTrail management events and AWS CloudTrail authentication events. Detecting impossible travel requires authentication logs (who logged in and from where) and timestamps. Cloud provider authentication logs (e.g., AWS CloudTrail for console logins, Azure AD sign-in logs) provide the necessary data.

Answer

Amazon GuardDuty findings and Security Hub

Answer

AWS Config history and resource inventory

Answer

VPC Flow Logs and DNS logs

Question 12

An organization wants to detect potential crypto mining activity on their AWS EC2 instances. Which AWS service uses machine learning to identify such threats?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious activity, including cryptocurrency mining (e.g., connections to known mining pools or unusual compute resource spikes). It analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS logs to identify behavioral patterns indicative of crypto mining, such as sustained outbound traffic to mining pool IPs or unusual EC2 instance launches.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Question 13

A security engineer needs to scan all container images stored in Amazon Elastic Container Registry (ECR) for vulnerabilities. The scan must be automated whenever a new image is pushed. Which solution meets this requirement?

Accepted Answer

Enable Amazon Inspector continuous scanning for ECR repositories.. Amazon Inspector continuous scanning for Amazon ECR automatically scans container images for software vulnerabilities whenever a new image is pushed to the repository. This feature is natively integrated with ECR, requires no additional infrastructure, and provides findings directly in the Inspector console and via AWS Security Hub. Option D is correct because it is the only AWS-native, automated, and fully managed solution that meets the requirement.

Answer

Use Amazon Macie for image scanning.

Answer

Configure AWS Security Hub to scan images.

Answer

Use AWS Lambda to invoke Clair on each push.

Question 14

During a cloud security incident, the incident response team needs to contain a compromised EC2 instance. Which action should be taken FIRST to prevent further malicious activity while preserving evidence?

Accepted Answer

Modify the security group associated with the instance to deny all traffic.. Option D is correct because modifying the security group to deny all traffic immediately isolates the compromised EC2 instance, preventing further malicious network activity while preserving the instance's state for forensic analysis. This containment step is reversible and does not destroy volatile data or system processes, unlike termination or snapshot creation, which can alter evidence.

Answer

Revoke the IAM role associated with the instance.

Answer

Create a snapshot of the instance volume for forensic analysis.

Answer

Terminate the EC2 instance immediately.

Question 15

A security team is investigating a potential credential compromise in AWS. They have CloudTrail logs showing an IAM user's access key was used to launch instances in a region where the user has never operated. What is the BEST course of action to confirm and contain the incident?

Accepted Answer

Check CloudTrail for the access key events, then rotate the key in IAM.. Option B is correct because the first step in confirming a potential credential compromise is to verify that the anomalous activity (instance launches in an unfamiliar region) is indeed associated with the specific access key in CloudTrail logs. Once confirmed, rotating the key (i.e., deactivating the old key and issuing a new one) immediately invalidates the compromised credential, stopping any further unauthorized use while preserving the user's ability to operate with a new key. This aligns with AWS's incident response best practices for IAM credential compromise.

Answer

Create a new IAM policy to deny all actions for that user.

Answer

Immediately delete all EC2 instances launched by that user.

Answer

Disable the user's console password and delete the access key.