CCSP Cloud Security Operations Practice Test 3 — 15 Questions

Question 1

An organization uses Azure Defender for Cloud to protect their hybrid environment. They want to receive alerts about suspicious activities on their Azure Key Vault. Which Defender plan should they enable?

Accepted Answer

Defender for Key Vault. Defender for Key Vault is the specific plan designed to provide advanced threat protection for Azure Key Vault. It monitors access patterns and operations on the vault to detect suspicious activities such as unauthorized access attempts, credential theft, or anomalous secret retrieval, and generates security alerts accordingly.

Answer

Defender for Databases

Answer

Defender for Containers

Answer

Defender for Servers

Question 2

What is the primary purpose of cloud security posture management (CSPM) tools such as AWS Security Hub, Azure Secure Score, and GCP Security Command Center?

Accepted Answer

To assess and improve the security configuration of cloud resources against benchmarks.. CSPM tools like AWS Security Hub, Azure Secure Score, and GCP Security Command Center are designed to continuously monitor cloud environments, assess configurations against industry benchmarks (e.g., CIS, NIST, PCI DSS), and provide remediation guidance. Their primary purpose is to identify misconfigurations and compliance gaps, not to perform real-time threat detection or centralized logging.

Answer

To provide a centralized log storage solution.

Answer

To detect real-time threats like malware and intrusions.

Answer

To manage user identities and access permissions.

Question 3

A security engineer needs to automate the remediation of any S3 bucket that is publicly accessible. The solution should work within a single AWS account and not require manual intervention. Which combination of services is MOST appropriate?

Accepted Answer

AWS Config rule + AWS Lambda auto-remediation. AWS Config can continuously evaluate S3 bucket settings against a custom or managed rule (e.g., s3-bucket-public-read-prohibited). When the rule detects a noncompliant bucket, it triggers an AWS Lambda function via auto-remediation, which can modify the bucket's ACL or policy to remove public access. This combination provides fully automated, event-driven remediation without manual steps.

Answer

Amazon GuardDuty + AWS Step Functions

Answer

AWS CloudTrail + Amazon SNS

Answer

AWS Trusted Advisor + AWS Systems Manager

Question 4

A cloud security team is designing an incident response playbook for a suspected data exfiltration via an AWS S3 bucket. Which TWO actions should be included for containment and evidence collection? (Choose two.)

Accepted Answer

Revoke IAM credentials associated with the compromised access.. For containment, revoking the IAM credentials used by the attacker stops further access. For evidence, enabling VPC Flow Logs (if not already enabled) captures network traffic for analysis.

Answer

Immediately notify all users to change passwords.

Answer

Take a snapshot of the S3 bucket using AWS Backup.

Answer

Delete the S3 bucket to prevent further access.

Question 5

A company uses GCP and wants to implement agentless vulnerability scanning for their Compute Engine instances. Which TWO services can provide this capability? (Choose two.)

Accepted Answer

Rapid7 InsightVM (agentless via API). Rapid7 InsightVM can perform agentless vulnerability scanning of GCP Compute Engine instances by leveraging the cloud provider's API to query instance configurations, installed software, and patch levels without requiring an agent on each VM. This is achieved through read-only API integrations that collect system metadata and compare it against vulnerability databases, making it a valid agentless scanning solution for GCP.

Answer

GCP Web Security Scanner

Answer

GCP Cloud Armor

Answer

Qualys Cloud Agent

Question 6

An organization is implementing a SOAR solution for cloud incident response. Which THREE capabilities are essential for automating incident response workflows? (Choose three.)

Accepted Answer

Integration with threat intelligence feeds. Integration with threat intelligence feeds (A) is essential because SOAR platforms ingest external threat data (e.g., STIX/TAXII feeds, CISA alerts) to enrich alerts and trigger automated responses. This allows the SOAR to correlate cloud events with known indicators of compromise (IOCs) and adjust playbooks dynamically without manual intervention.

Answer

Manual ticketing system

Answer

Real-time user activity monitoring

Question 7

A security team is configuring AWS CloudTrail to enable detection of unauthorized API calls. They want to ensure that log files cannot be tampered with after delivery. Which CloudTrail feature should they enable?

Accepted Answer

CloudTrail Log File Validation. CloudTrail Log File Validation (option B) uses a SHA-256 hash chain to create a digital signature for each log file, enabling integrity verification. When enabled, CloudTrail delivers digest files that contain hashes of log files, allowing you to confirm that log files were not modified, deleted, or tampered with after delivery. This directly addresses the requirement to detect unauthorized API calls by ensuring the logs themselves are trustworthy.

Answer

CloudTrail Insights

Answer

CloudTrail Multi-Region Trail

Answer

CloudTrail Event History

Question 8

An organization uses AWS GuardDuty for threat detection. A finding indicates that an EC2 instance is communicating with a known cryptocurrency mining pool. What type of threat does this represent?

Accepted Answer

Crypto mining on EC2. AWS GuardDuty detects threats by analyzing VPC Flow Logs, DNS logs, and CloudTrail events. A finding of communication with a known cryptocurrency mining pool indicates that the EC2 instance is likely compromised and running crypto mining software, which consumes excessive compute resources and represents a malicious activity type known as crypto mining.

Answer

Reconnaissance port scanning

Answer

Ransomware activity

Answer

Compromised IAM credentials exfiltration

Question 9

During a cloud security incident, the response team needs to collect evidence from a compromised AWS EC2 instance. Which method is most appropriate for capturing volatile data while preserving forensic integrity?

Accepted Answer

Take an EBS snapshot of the instance's volumes. Option C is correct because an EBS snapshot captures the entire volume state, including memory swap and temporary files, at a point in time without altering the instance's runtime state. This preserves forensic integrity by avoiding writes to the disk (which would occur with SSH or reboot) and provides a forensically sound copy for offline analysis.

Answer

Terminate the instance and launch a replacement

Answer

Create a memory dump by SSH and save to S3

Answer

Reboot the instance and collect logs

Question 10

A company uses Azure Policy with remediation tasks to automatically fix non-compliant resources. Which scenario can be automatically remediated using a built-in policy?

Accepted Answer

A virtual machine missing the Log Analytics agent. The built-in Azure Policy 'Deploy Log Analytics agent to Windows VMs' includes a remediation task that automatically installs the Log Analytics agent on existing VMs that are missing it. This is a DeployIfNotExists policy effect, which triggers a remediation task to correct non-compliance without manual intervention.

Answer

A user creating a new Azure subscription

Answer

A SQL database with advanced data security disabled

Answer

A storage account with public network access enabled

Question 11

A security analyst reviews GCP Security Command Center findings and sees a high-severity alert for Event Threat Detection indicating that a service account key was used from an unexpected location. What is the best immediate action to contain the threat?

Accepted Answer

Disable the service account key. The correct immediate action is to disable the compromised service account key because Event Threat Detection has identified that the key is being used from an unexpected location, indicating potential unauthorized access. Disabling the key stops all further usage without deleting the service account or its other keys, preserving legitimate operations. This aligns with the principle of least privilege and incident response containment, as the key can later be rotated or deleted after investigation.

Answer

Create a new service account

Answer

Delete the service account

Answer

Rotate the key and monitor

Question 12

An organization ingests AWS CloudTrail logs into a centralized SIEM for correlation. They want to detect an attacker who exfiltrates data by downloading large volumes from an S3 bucket. Which SIEM correlation rule would best detect this?

Accepted Answer

Alert on high volume of GetObject requests from a single IP. Option B is correct because exfiltration of data from S3 typically involves a high volume of GetObject API calls from a single source IP. A SIEM correlation rule that triggers on a threshold of GetObject requests from the same IP address directly detects this anomalous download behavior, which is a key indicator of data exfiltration.

Answer

Alert on multiple failed login attempts

Answer

Alert on root account usage

Answer

Alert when a new IAM user is created

Question 13

A cloud security engineer needs to implement a solution to detect configuration drift against CIS benchmarks for AWS workloads. Which tool or service is specifically designed for cloud security posture management (CSPM) in AWS?

Accepted Answer

AWS Security Hub. AWS Security Hub is a cloud security posture management (CSPM) service that aggregates security findings from multiple AWS services and third-party tools, and it can continuously monitor AWS workloads against CIS AWS Foundations Benchmarks. It provides automated compliance checks, consolidated dashboards, and remediation guidance specifically designed for detecting configuration drift from benchmark standards.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Inspector

Question 14

A company uses Azure Sentinel as its SIEM. To ingest Azure Activity Logs and correlate with other data sources, which connector should be configured?

Accepted Answer

Azure Activity connector. The Azure Activity connector is specifically designed to ingest Azure Activity Logs, which contain subscription-level events such as resource creation, modification, and deletion. This connector enables Sentinel to correlate these operational logs with other data sources for comprehensive threat detection and incident response.

Answer

Office 365 connector

Answer

Azure Defender connector

Answer

Windows Security Events connector

Question 15

A security team is implementing vulnerability management in a hybrid cloud environment. They need to scan virtual machines without installing an agent. Which approach is most suitable?

Accepted Answer

Agentless scanning using cloud APIs. Agentless scanning using cloud APIs (Option B) is the correct approach because it allows the security team to scan virtual machines without installing any software on the VMs themselves. This method leverages cloud provider APIs (e.g., AWS EC2 DescribeInstances, Azure VM REST APIs) to query the hypervisor or management plane for VM configurations, patch levels, and vulnerabilities, making it ideal for hybrid cloud environments where agent deployment may be impractical or restricted.

Answer

Deploying a third-party vulnerability scanner on each VM

Answer

Agent-based scanning with AWS Inspector

Answer

Using container image scanning in registry