CCSP Cloud Security Operations Practice Test 3 — 15 Questions

Question 1

An organization wants to detect potential crypto mining activity on their AWS EC2 instances. Which AWS service uses machine learning to identify such threats?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious activity, including cryptocurrency mining (e.g., connections to known mining pools or unusual compute resource spikes). It analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS logs to identify behavioral patterns indicative of crypto mining, such as sustained outbound traffic to mining pool IPs or unusual EC2 instance launches.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Question 2

During a cloud security incident, the incident response team needs to contain a compromised cloud instance. Which action should be taken FIRST to prevent further malicious activity while preserving evidence?

Accepted Answer

Modify the network security rule associated with the instance to deny all traffic.. Modifying the network security rule to deny all traffic immediately isolates the compromised cloud instance, preventing further malicious network activity while preserving the instance's state for forensic analysis. This containment step is reversible and does not destroy volatile data or system processes, unlike termination or snapshot creation, which can alter evidence.

Answer

Revoke the role associated with the instance.

Answer

Create a snapshot of the instance volume for forensic analysis.

Answer

Terminate the instance immediately.

Question 3

A security team is investigating a potential credential compromise in a cloud environment. They have cloud audit logs showing a user's access key was used to provision compute instances in a geographic region where the user has never operated. What is the BEST course of action to confirm and contain the incident?

Accepted Answer

Check cloud audit logs for the access key events, then rotate the access key.. The first step in confirming a potential credential compromise is to verify that the anomalous activity (instance launches in an unfamiliar region) is indeed associated with the specific access key in the audit logs. Once confirmed, rotating the key (i.e., deactivating the old key and issuing a new one) immediately invalidates the compromised credential, stopping any further unauthorized use while preserving the user's ability to operate with a new key. This aligns with cloud security incident response best practices for credential compromise.

Answer

Create a new access policy to deny all actions for that user.

Answer

Immediately delete all compute instances launched by that user.

Answer

Disable the user's console access and delete the access key.

Question 4

An organization uses Azure Defender for Cloud to protect their hybrid environment. They want to receive alerts about suspicious activities on their Azure Key Vault. Which Defender plan should they enable?

Accepted Answer

Defender for Key Vault. Defender for Key Vault is the specific plan designed to provide advanced threat protection for Azure Key Vault. It monitors access patterns and operations on the vault to detect suspicious activities such as unauthorized access attempts, credential theft, or anomalous secret retrieval, and generates security alerts accordingly.

Answer

Defender for Databases

Answer

Defender for Containers

Answer

Defender for Servers

Question 5

What is the primary purpose of cloud security posture management (CSPM) tools?

Accepted Answer

To assess and improve the security configuration of cloud resources against benchmarks.. CSPM tools are designed to continuously monitor cloud environments, assess configurations against industry benchmarks (e.g., CIS, NIST, PCI DSS), and provide remediation guidance. Their primary purpose is to identify misconfigurations and compliance gaps, not to perform real-time threat detection or centralized logging.

Answer

To provide a centralized log storage solution.

Answer

To detect real-time threats like malware and intrusions.

Answer

To manage user identities and access permissions.

Question 6

A security engineer needs to automate the remediation of any S3 bucket that is publicly accessible. The solution should work within a single AWS account and not require manual intervention. Which combination of services is MOST appropriate?

Accepted Answer

AWS Config rule + AWS Lambda auto-remediation. AWS Config can continuously evaluate S3 bucket settings against a custom or managed rule (e.g., s3-bucket-public-read-prohibited). When the rule detects a noncompliant bucket, it triggers an AWS Lambda function via auto-remediation, which can modify the bucket's ACL or policy to remove public access. This combination provides fully automated, event-driven remediation without manual steps.

Answer

Amazon GuardDuty + AWS Step Functions

Answer

AWS CloudTrail + Amazon SNS

Answer

AWS Trusted Advisor + AWS Systems Manager

Question 7

A cloud security team is designing an incident response playbook for a suspected data exfiltration via an AWS S3 bucket. Which TWO actions should be included for containment and evidence collection? (Choose two.)

Accepted Answer

Revoke IAM credentials associated with the compromised access.. For containment, revoking the IAM credentials used by the attacker stops further access. For evidence, enabling VPC Flow Logs (if not already enabled) captures network traffic for analysis.

Answer

Immediately notify all users to change passwords.

Answer

Take a snapshot of the S3 bucket using AWS Backup.

Answer

Delete the S3 bucket to prevent further access.

Question 8

A company uses GCP and wants to implement agentless vulnerability scanning for their Compute Engine instances. Which TWO services can provide this capability? (Choose two.)

Accepted Answer

Rapid7 InsightVM (agentless via API). Rapid7 InsightVM can perform agentless vulnerability scanning of GCP Compute Engine instances by leveraging the cloud provider's API to query instance configurations, installed software, and patch levels without requiring an agent on each VM. This is achieved through read-only API integrations that collect system metadata and compare it against vulnerability databases, making it a valid agentless scanning solution for GCP.

Answer

GCP Web Security Scanner

Answer

GCP Cloud Armor

Answer

Qualys Cloud Agent

Question 9

An organization is implementing a SOAR solution for cloud incident response. Which THREE capabilities are essential for automating incident response workflows? (Choose three.)

Accepted Answer

Integration with threat intelligence feeds. Integration with threat intelligence feeds (A) is essential because SOAR platforms ingest external threat data (e.g., STIX/TAXII feeds, CISA alerts) to enrich alerts and trigger automated responses. This allows the SOAR to correlate cloud events with known indicators of compromise (IOCs) and adjust playbooks dynamically without manual intervention.

Answer

Manual ticketing system

Answer

Real-time user activity monitoring

Question 10

A security team is configuring AWS CloudTrail to enable detection of unauthorized API calls. They want to ensure that log files cannot be tampered with after delivery. Which CloudTrail feature should they enable?

Accepted Answer

CloudTrail Log File Validation. CloudTrail Log File Validation (option B) uses a SHA-256 hash chain to create a digital signature for each log file, enabling integrity verification. When enabled, CloudTrail delivers digest files that contain hashes of log files, allowing you to confirm that log files were not modified, deleted, or tampered with after delivery. This directly addresses the requirement to detect unauthorized API calls by ensuring the logs themselves are trustworthy.

Answer

CloudTrail Insights

Answer

CloudTrail Multi-Region Trail

Answer

CloudTrail Event History

Question 11

An organization uses a cloud security monitoring service for threat detection. A finding indicates that a virtual machine instance is communicating with a known cryptocurrency mining pool. What type of threat does this represent?

Accepted Answer

Crypto mining on a virtual machine. A cloud security monitoring service detects threats by analyzing network traffic logs, DNS logs, and API call logs. A finding of communication with a known cryptocurrency mining pool indicates that the virtual machine instance is likely compromised and running crypto mining software, which consumes excessive compute resources and represents a malicious activity type known as crypto mining.

Answer

Reconnaissance port scanning

Answer

Ransomware activity

Answer

Compromised credentials exfiltration

Question 12

During a cloud security incident, the response team needs to collect evidence from a compromised AWS EC2 instance. Which method is most appropriate for capturing volatile data while preserving forensic integrity?

Accepted Answer

Create a memory dump by SSH and save to S3. The most appropriate method for capturing volatile data (memory) from a compromised EC2 instance. Using SSH to perform a memory dump (e.g., via LiME or fmem) and saving the output to S3 captures RAM contents, which is volatile and critical for incident response. While SSH access alters system state, it is the standard approach for remote memory acquisition when direct physical access is unavailable. Option C (EBS snapshot) captures persistent storage, not volatile memory, so it is incorrect for the stated requirement.

Answer

Terminate the instance and launch a replacement

Answer

Take an EBS snapshot of the instance's volumes

Answer

Reboot the instance and collect logs

Question 13

A company uses Azure Policy with remediation tasks to automatically fix non-compliant resources. Which scenario can be automatically remediated using a built-in policy?

Accepted Answer

A virtual machine missing the Log Analytics agent. The built-in Azure Policy 'Deploy Log Analytics agent to Windows VMs' includes a remediation task that automatically installs the Log Analytics agent on existing VMs that are missing it. This is a DeployIfNotExists policy effect, which triggers a remediation task to correct non-compliance without manual intervention.

Answer

A user creating a new Azure subscription

Answer

A SQL database with advanced data security disabled

Answer

A storage account with public network access enabled

Question 14

A security analyst reviews GCP Security Command Center findings and sees a high-severity alert for Event Threat Detection indicating that a service account key was used from an unexpected location. What is the best immediate action to contain the threat?

Accepted Answer

Disable the service account key. The correct immediate action is to disable the compromised service account key because Event Threat Detection has identified that the key is being used from an unexpected location, indicating potential unauthorized access. Disabling the key stops all further usage without deleting the service account or its other keys, preserving legitimate operations. This aligns with the principle of least privilege and incident response containment, as the key can later be rotated or deleted after investigation.

Answer

Create a new service account

Answer

Delete the service account

Answer

Rotate the key and monitor

Question 15

An organization ingests AWS CloudTrail logs into a centralized SIEM for correlation. They want to detect an attacker who exfiltrates data by downloading large volumes from an S3 bucket. Which SIEM correlation rule would best detect this?

Accepted Answer

Alert on high volume of GetObject requests from a single IP. Exfiltration of data from S3 typically involves a high volume of GetObject API calls from a single source IP. A SIEM correlation rule that triggers on a threshold of GetObject requests from the same IP address directly detects this anomalous download behavior, which is a key indicator of data exfiltration.

Answer

Alert on multiple failed login attempts

Answer

Alert on root account usage

Answer

Alert when a new IAM user is created