CCSP Cloud Security Operations Practice Test 3 — 15 Questions

Question 1

During a cloud incident response, a security team needs to isolate a compromised EC2 instance to prevent further communication with an external command-and-control server. Which step should be taken first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the security group to deny all outbound traffic. Modifying the security group to deny all outbound traffic is the fastest way to cut communication between the compromised EC2 instance and the external C2 server without destroying volatile data. Security groups act as a stateful virtual firewall at the instance level, and changing the outbound rule to deny all traffic immediately blocks any existing or new connections to the C2 IP. This preserves the instance's runtime state for later forensic analysis while containing the threat.

Answer

Take a forensic snapshot of the instance’s EBS volume

Answer

Revoke the IAM credentials associated with the instance’s role

Answer

Stop the EC2 instance

Question 2

During a forensic investigation of a compromised AWS account, the incident response team needs to determine the exact time an attacker created a new IAM user and what permissions were assigned. Which log source would provide the most reliable evidence?

Accepted Answer

AWS CloudTrail management events. AWS CloudTrail management events capture all API calls made to the AWS Management Console, SDKs, CLI, and AWS services, including IAM CreateUser and AttachUserPolicy actions. These events record the exact timestamp, source IP, user agent, and the identity of the principal making the call, making them the definitive source for determining when an IAM user was created and what permissions were assigned.

Answer

AWS Config configuration history for the IAM user

Answer

S3 access logs for the bucket containing IAM policy files

Answer

VPC Flow Logs for the management console IP

Question 3

A financial services firm hosts a latency-sensitive trading application on Amazon EC2 instances behind an Application Load Balancer. A recent penetration test revealed that the application is vulnerable to HTTP flood and slowloris attacks. The security team must deploy protection that inspects Layer 7 traffic, applies rate-based rules, and integrates with AWS WAF. Which service should be placed in front of the Application Load Balancer to meet these requirements?

Accepted Answer

AWS WAF with rate-based rules attached to the Application Load Balancer. Mitigating HTTP flood and slowloris attacks requires Layer 7 inspection and the ability to rate-limit requests per source. AWS WAF attached to the Application Load Balancer provides exactly that: it inspects HTTP requests and enforces rate-based rules that block or challenge abusive sources. Shield Advanced, Shield Standard, and Network Load Balancers operate at lower layers and do not deliver application-layer request inspection or rate-based rules.

Answer

Amazon CloudFront with AWS Shield Standard enabled

Answer

A Network Load Balancer with AWS Shield Advanced

Answer

AWS Shield Advanced

Question 4

A cloud operations team manages a fleet of Amazon EC2 instances running a custom application. The security policy mandates that any configuration change to these instances must be detected within 5 minutes and trigger an automated remediation workflow. The team already uses AWS Systems Manager to manage the instances. Which approach BEST meets these requirements?

Accepted Answer

Enable AWS Config with the managed rule 'ec2-instance-managed-by-systems-manager' and configure an Amazon EventBridge rule to invoke an AWS Lambda function when the rule is non-compliant.. AWS Config is designed to continuously assess, audit, and evaluate the configurations of AWS resources. By using a managed rule that checks for Systems Manager management, the team can detect non-compliant instances. EventBridge can then trigger a Lambda function for automated remediation. This combination provides near-real-time detection and automated response, meeting the 5-minute requirement and leveraging existing Systems Manager usage.

Answer

Use AWS CloudTrail to log all API calls and create a CloudWatch Logs metric filter for any EC2 configuration change. Configure a CloudWatch alarm to send an Amazon SNS notification to the security team.

Answer

Configure AWS Trusted Advisor to monitor EC2 instances and use its recommendations to trigger an AWS Lambda function via Amazon EventBridge when a configuration change is detected.

Answer

Install the Amazon CloudWatch agent on each instance to collect configuration data and publish custom metrics. Create a CloudWatch alarm that triggers an AWS Lambda function when a metric indicates a change.

Question 5

A financial services company uses AWS Lambda functions to process sensitive transactions. A security audit reveals that the functions have overly permissive IAM roles and that some functions have environment variables containing database credentials in plaintext. The security team needs to remediate these issues without disrupting the serverless application. Which combination of actions should they take?

Accepted Answer

Use AWS Secrets Manager to store the credentials and modify the Lambda functions to retrieve them at runtime, and apply least privilege to the IAM roles by analyzing access with IAM Access Analyzer.. AWS Secrets Manager provides secure storage and automatic rotation of credentials, and Lambda functions can retrieve secrets at runtime, eliminating plaintext environment variables. IAM Access Analyzer analyzes resource policies and generates findings for overly permissive access, helping to refine IAM roles to least privilege. This combination addresses both security issues while maintaining application functionality.

Answer

Encrypt the environment variables using AWS KMS and restrict access to the KMS key, and enable AWS CloudTrail to monitor Lambda invocations.

Answer

Store the credentials in an Amazon S3 bucket with server-side encryption and have Lambda read them from there, and use AWS Trusted Advisor to identify overly permissive IAM roles.

Answer

Move the credentials to AWS Systems Manager Parameter Store as SecureString parameters and use IAM policies to restrict access, and enable AWS Config rules to detect overly permissive roles.

Question 6

A cloud security engineer at a media company is configuring centralized logging for an AWS Organization. The team wants all AWS CloudTrail management events from every member account delivered to a single S3 bucket in the log archive account. The engineer creates an organization trail in the management account and specifies the S3 bucket in the log archive account. After 24 hours, no logs appear in the bucket. Which action is MOST likely required to resolve the issue?

Accepted Answer

Update the S3 bucket policy on the log archive bucket to grant the CloudTrail service principal permission to write objects and check the bucket's ACL settings.. Organization trails deliver logs to a central S3 bucket only when the bucket policy explicitly grants the CloudTrail service principal s3:PutObject and related permissions, and the bucket belongs to the same organization. Without that policy, CloudTrail silently fails to deliver. Options involving Insights, Block Public Access, or AWS Config do not address the permission requirement for cross-account log delivery.

Answer

Enable S3 Block Public Access on the log archive bucket to allow CloudTrail to write logs.

Answer

Enable AWS CloudTrail Insights on the organization trail to generate the missing events.

Answer

Configure AWS Config to record resource changes in the log archive account so CloudTrail can forward events.

Question 7

A security operations team must ensure that cryptographic keys used to encrypt data at rest in their cloud environment are rotated automatically every 90 days and that the rotation is auditable. They use a cloud KMS that supports customer-managed keys. Which action BEST satisfies the requirement?

Accepted Answer

Enable automatic key rotation on the customer-managed key with a 90-day rotation period and use CloudTrail to log key rotation events.. Customer-managed keys in a cloud KMS support configurable automatic rotation, which creates new cryptographic material on a schedule you define while keeping the same key identifier so existing data remains accessible. Enabling a 90-day rotation period satisfies the schedule, and CloudTrail captures rotation API calls so the event is auditable without manual intervention or re-encryption of data.

Answer

Import your own key material into KMS and rotate it by re-importing new material every 90 days.

Answer

Manually create a new customer-managed key every 90 days and re-encrypt all data with the new key using a scheduled Lambda function.

Answer

Use an AWS managed key (aws/service) and enable rotation through the service that owns the key.

Question 8

A financial services firm runs workloads in Microsoft Azure. Their security policy requires that all administrative actions on production resources be logged and that the logs be stored immutably for seven years. The compliance team also needs to query these logs for investigations. Which combination of Azure features should the cloud security team implement?

Accepted Answer

Azure Monitor activity log with diagnostic settings exporting to a storage account configured with a time-based retention policy and immutable blob storage.. The activity log captures subscription-level administrative operations. Exporting it via diagnostic settings to a storage account with immutable blob storage and a time-based retention policy creates a tamper-proof, queryable archive for seven years. Event Hubs, Log Analytics, and Azure SQL do not provide immutable WORM storage for that duration, so they fail the compliance requirement.

Answer

Azure Monitor activity log with diagnostic settings exporting to an Azure SQL Database with auditing enabled and a seven-year retention policy.

Answer

Azure Monitor activity log with diagnostic settings exporting to a Log Analytics workspace configured with a seven-year data retention setting.

Answer

Azure Monitor activity log with diagnostic settings exporting to an Azure Event Hubs namespace configured with a seven-year message retention period.

Question 9

A healthcare organization is migrating its on-premises patient records system to Microsoft Azure. The security team must ensure that data at rest and in transit is protected according to HIPAA requirements. They plan to use Azure services for encryption and key management. Which TWO actions should they take to meet these requirements? (Choose two.)

Accepted Answer

Enable Azure Storage Service Encryption for Azure Blob Storage and Azure Files to encrypt data at rest.. To meet HIPAA requirements for data at rest and in transit, the organization should encrypt data at rest using Azure Storage Service Encryption and manage keys with Azure Key Vault. Storage Service Encryption encrypts blobs and files, while Key Vault provides secure key management and access control. Together, they ensure that patient data is encrypted and keys are protected.

Answer

Enable HTTPS/TLS for all Azure services and use Azure Application Gateway with SSL termination.

Answer

Use Azure Disk Encryption to encrypt virtual machine disks and Azure Storage Service Encryption for data at rest.

Answer

Implement Azure VPN Gateway to encrypt all traffic between on-premises and Azure.

Question 10

A financial services company runs a critical workload on Google Cloud Platform (GCP). The security team needs to ensure that all administrative activities on the project are logged and that logs are retained for 365 days for compliance. They also need to be able to search and analyze these logs quickly. Which combination of GCP services and configurations should they use?

Accepted Answer

Enable Cloud Audit Logs for all services, create a log sink to a Cloud Storage bucket with a 365-day retention policy, and use BigQuery to analyze the logs.. Cloud Audit Logs provide the necessary administrative activity logging. To meet the 365-day retention, logs must be exported to a durable storage service like Cloud Storage with a retention policy. For fast search and analysis, BigQuery is the appropriate choice because it supports SQL queries over large datasets. This combination ensures compliance and enables efficient analysis.

Answer

Enable Cloud Audit Logs for all services, create a log sink to Cloud Logging with a 365-day retention policy, and use the Logs Explorer for analysis.

Answer

Enable Cloud Audit Logs for all services, create a log sink to Pub/Sub, and use Dataflow to stream logs to BigQuery for analysis with a 365-day retention in BigQuery.

Answer

Enable Cloud Audit Logs for all services, create a log sink to Cloud Storage with a 365-day retention policy, and use Cloud Logging's Logs Explorer to analyze the logs stored in Cloud Storage.

Question 11

A cloud security team is implementing a security information and event management (SIEM) solution in Microsoft Azure. They need to collect security logs from various sources, including Azure Active Directory, Azure Activity Logs, and virtual machine event logs. The team wants to use a native Azure service that can ingest these logs and provide analysis and alerting capabilities. Which TWO services should they use? (Choose two.)

Accepted Answer

Azure Sentinel. Azure Monitor Logs and Azure Sentinel together provide a native SIEM solution in Azure. Azure Monitor Logs serves as the data collection and analysis platform, while Azure Sentinel adds SIEM and SOAR capabilities on top. They integrate to ingest and analyze logs from Microsoft Entra ID, Activity Logs, and VM event logs, enabling comprehensive security monitoring.

Answer

Azure Security Center

Answer

Azure Network Watcher

Answer

Azure Event Hubs

Question 12

A cloud security team is responsible for monitoring a multi-cloud environment that includes AWS and Azure. They need to implement a centralized logging solution that aggregates security logs from both clouds and supports real-time analysis and alerting. Which TWO services should they use to achieve this? (Choose two.)

Accepted Answer

AWS CloudWatch Logs and Azure Log Analytics. To centralize logging across AWS and Azure, you need services that capture logs and services that aggregate and analyze them. CloudTrail and Azure Monitor activity log are the primary sources of control plane logs. CloudWatch Logs and Azure Log Analytics are the platforms for aggregation, real-time analysis, and alerting. Together, they form a centralized logging solution.

Answer

AWS Config and Azure Policy

Answer

Amazon S3 and Azure Blob Storage

Answer

AWS Security Hub and Azure Security Center (Microsoft Defender for Cloud)

Question 13

A DevSecOps team uses Google Cloud. They need to ensure that any Compute Engine instance created with a public IP address is automatically detected and that the security team is notified within minutes. The solution should require minimal custom code and integrate with existing incident management. Which approach should they use?

Accepted Answer

Create a Cloud Logging log-based alert on the compute.instances.insert audit log entry filtered for external IPs, and route it to a Pub/Sub topic that triggers a Cloud Function to send a notification.. Cloud Audit Logs include Admin Activity entries for compute.instances.insert that contain the instance's network interfaces, including external IPs. A log-based alert can match those entries and publish to Pub/Sub, where a Cloud Function forwards notifications to incident management. This is a native, low-code, near-real-time detection path. Flow logs, Security Command Center, and agents do not meet the timing or minimal-code requirements.

Answer

Deploy an agent on each instance that reports its external IP to a custom API, which then sends alerts.

Answer

Use Security Command Center Premium findings for public IP addresses and configure a notification channel to email the security team.

Answer

Enable VPC Flow Logs on all subnets and create a log-based alert for outbound traffic from new instances to the internet.

Question 14

A cloud security team is implementing a vulnerability management program for their Microsoft Azure environment. They need to identify vulnerabilities in operating system and software configurations on their virtual machines without installing agents on each VM. Which TWO Azure services should they use? (Choose two.)

Accepted Answer

Azure Arc. Microsoft Defender for Cloud provides agentless vulnerability assessment for Azure VMs, and Azure Arc extends this capability to hybrid and multi-cloud servers. Together, they enable agentless scanning across the environment. Other options either require agents, are not vulnerability scanners, or are outdated service names.

Answer

Azure Sentinel

Answer

Azure Update Management

Answer

Azure Security Center

Question 15

A cloud administrator needs to grant a third-party auditing firm read-only access to compliance reports and configuration evidence stored in a cloud object storage bucket for a limited 30-day period. The firm should not be able to modify or delete any objects. Which approach is MOST appropriate?

Accepted Answer

Create an IAM role with a read-only policy scoped to the specific bucket prefix and a trust policy that allows the firm's account to assume it, with a maximum session duration of 30 days.. A cross-account IAM role scoped to the specific bucket prefix enforces least privilege and avoids sharing long-term credentials. The trust policy allows only the auditing firm's account to assume the role, and a maximum session duration of 30 days makes access time-bound. Access is logged under the assumed role identity, supporting accountability without exposing data publicly or creating unmanageable credentials.

Answer

Make the bucket public for 30 days so the auditing firm can access the reports without authentication, then revert the change.

Answer

Create a presigned URL for each object with a 30-day expiration and share the URLs with the auditing firm.

Answer

Generate a long-term IAM user access key with read-only permissions and send the credentials to the auditing firm via email.