CCSP Cloud Security Operations Practice Test 4 — 15 Questions

Question 1

A financial services firm runs a production workload on AWS and needs to prove to regulators that a specific S3 object containing customer records was never altered between January and June. The security team must be able to demonstrate integrity with cryptographic evidence rather than relying on access logs alone. Which approach provides the strongest verifiable proof?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use S3 checksums with SHA-256 and retain the recorded checksum values to compare against the object's current digest. Proving an object was never altered requires a cryptographic digest that can be recomputed and compared. S3 additional checksums with SHA-256 provide exactly that: a content hash recorded at write time and verifiable later against the stored object. Access logs, versioning, and Object Lock are valuable controls but do not by themselves furnish the cryptographic integrity evidence requested.

Answer

Enable S3 server access logging and review the PUT and DELETE entries for the object over the six-month period

Answer

Enable S3 Versioning and compare the version IDs recorded in CloudTrail for the object across the period

Answer

Configure S3 Object Lock in compliance mode with a retention period covering the six months

Question 2

A security engineer needs to ensure that all API calls made to cloud resources are logged for auditing. Which cloud auditing feature should be enabled to capture management and data events?

Accepted Answer

Cloud audit logging service. Cloud audit logging service (e.g., AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) is the correct feature because it captures API calls made to cloud resources, including management and data events, for auditing purposes. It records who made the call, when, from where, and what was done, providing the necessary audit trail. This is the standard service for logging API activity across cloud providers.

Answer

Cloud monitoring and logging service

Answer

Configuration management service

Answer

Threat detection service

Question 3

A security analyst is investigating a potential breach and needs to verify the integrity of audit logs stored in cloud storage. Which feature should the analyst rely on to confirm that logs have not been tampered with?

Accepted Answer

Log file integrity validation. Log file integrity validation is the cloud-native feature (e.g., AWS CloudTrail log file integrity validation) that uses cryptographic hashing and digital signatures to prove that log files have not been altered or deleted after delivery. It produces a digest file for each log delivery containing SHA-256 hashes and a signature, allowing the analyst to verify tamper-evidence. This directly answers the requirement to 'confirm logs have not been tampered with.'

Answer

Server-side encryption of logs

Answer

Anomaly detection on logs

Answer

Immutable storage for logs

Question 4

An organization uses a cloud-based SIEM solution. Which cloud service provides native integration to stream audit logs into the SIEM?

Accepted Answer

Centralized logging service. A centralized logging service is the cloud service that natively aggregates audit logs from multiple sources and can stream them into a SIEM, because its core function is to collect, store, and forward log data. Native integration to stream audit logs into a SIEM is a defining capability of centralized logging services such as AWS CloudTrail with CloudWatch Logs, Azure Monitor Logs, or Google Cloud Logging. The other options describe different security functions that do not provide the log-streaming pipeline the SIEM needs.

Answer

Security monitoring service

Answer

Policy management service

Answer

Recommendation service

Question 5

A SOC analyst notices an alert for 'impossible travel' where a user logged in from New York and then from London within 15 minutes. The SIEM correlation rule likely compares which log fields?

Accepted Answer

Source IP address and timestamp. Impossible travel detection correlates the geographic location derived from the source IP address with the login timestamp to compute whether the physical distance between two logins could be traveled in the elapsed time. If the implied speed exceeds a threshold (e.g., faster than commercial air travel), the SIEM flags the event as impossible travel.

Answer

User agent and browser type

Answer

Destination IP and port

Answer

Volume of data transferred and timestamp

Question 6

A security team needs to implement automated remediation for non-compliant resources in a cloud environment. They want to automatically fix public object storage bucket policies. Which combination of services should be used?

Accepted Answer

Configuration management service and serverless compute function. Automated remediation of non-compliant resources requires a configuration management service to detect and evaluate compliance (e.g., AWS Config rules) and a serverless compute function (e.g., AWS Lambda) to execute the remediation action, such as modifying a public S3 bucket policy. This combination enables event-driven, automatic correction without manual intervention.

Answer

Audit logging service and serverless compute function

Answer

Threat detection service and workflow orchestration service

Answer

Security hub and vulnerability management service

Question 7

A cloud security architect is evaluating vulnerability management solutions for a hybrid cloud environment. The team needs to scan both on-premises servers and cloud workloads without installing agents on every system. Which approach is most suitable for cloud workloads?

Accepted Answer

Agentless scanning via cloud APIs (CSPM). Agentless scanning uses cloud APIs to assess vulnerabilities without requiring an agent on each instance. This is ideal for cloud workloads where agents may not be desired.

Answer

Agent-based scanning using a cloud-native service

Answer

Network vulnerability scanning from a remote scanner

Answer

Container image scanning only

Question 8

After a security incident involving a compromised access key, a security engineer needs to collect forensic evidence from the cloud environment. Which of the following actions would be most useful for determining the timeline of the compromise?

Accepted Answer

Reviewing cloud audit logs for the compromised key. Cloud audit logs contain detailed records of all API calls, including the identity, timestamp, and source IP. Analyzing these logs helps establish the timeline of when the key was used.

Answer

Taking a memory dump of the compute instance

Answer

Analyzing network flow logs for data exfiltration

Answer

Checking configuration management logs for resource changes

Question 9

Which AWS service uses machine learning to detect threats such as crypto mining activity on EC2 instances and compromised IAM credentials?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify malicious activity.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Inspector

Question 10

An organization uses GCP and wants to monitor for threats in real-time, including detecting malicious activity from compromised service accounts. Which GCP service should be used?

Accepted Answer

Event Threat Detection. Event Threat Detection is part of GCP Security Command Center and provides real-time threat detection for IAM anomalies, including compromised service accounts.

Answer

Cloud Audit Logs

Answer

Cloud Security Scanner

Answer

Container Threat Detection

Question 11

A company uses Azure Defender for Cloud to protect its hybrid environment. Which of the following is a feature of Azure Defender that provides vulnerability assessment for virtual machines?

Accepted Answer

Defender for Servers. Azure Defender includes integrated vulnerability assessment via Qualys or Microsoft built-in scanner, available for Defender for Servers.

Answer

Azure Secure Score

Answer

Azure Policy

Answer

Azure Sentinel

Question 12

During incident response in a cloud environment, a team needs to collect evidence from a compromised EC2 instance without altering the system. Which of the following is the best method to obtain a forensic memory dump?

Accepted Answer

Use the AWS CLI to execute a memory dump script on the instance (e.g., via AWS Systems Manager Run Command). Using AWS Systems Manager Run Command to execute a memory dump script on the instance allows the team to capture volatile memory (RAM) while the instance is still running, preserving the system state. This method does not require stopping or modifying the instance, and it can be done remotely via the AWS CLI, making it the best option for forensic memory acquisition.

Answer

Create an AMI of the instance

Answer

Enable detailed billing reports

Answer

Take a snapshot of the root EBS volume

Question 13

An organization wants to implement a cloud security automation solution that can automatically remediate non-compliant resources in Azure. Which Azure service should be used to create remediation tasks?

Accepted Answer

Azure Policy. Azure Policy includes 'remediation tasks' that can automatically fix non-compliant resources, often using managed identities.

Answer

Azure Security Center

Answer

Azure Automation

Answer

Azure Logic Apps

Question 14

A security team is investigating a potential data exfiltration incident where a large volume of data was downloaded from a cloud storage bucket. Which log source would provide the most granular details about the GET requests, including the requester identity and source IP?

Accepted Answer

Cloud storage access logs. Cloud storage access logs provide detailed records of requests made to a bucket, including requester, source IP, and objects accessed. Cloud audit logs (data events) can also log storage operations, but storage access logs are more granular for this purpose.

Answer

VPC flow logs

Answer

Cloud management events (e.g., CloudTrail equivalent)

Answer

Log aggregation service for storage (e.g., CloudWatch equivalent)

Question 15

A security architect is designing a logging strategy for a multi-cloud environment using AWS and Azure. Which TWO practices should be implemented to ensure log integrity and prevent tampering? (Choose two.)

Accepted Answer

Enable CloudTrail log file validation. Option C is correct because CloudTrail log file validation generates a digitally signed digest file for each log file, allowing you to verify that logs have not been altered or deleted after delivery. Option D is correct because S3 Object Lock (in compliance or governance mode) and Azure Immutable Blob Storage enforce WORM (write once, read many) policies, preventing logs from being modified or deleted during a retention period. Option A is wrong because a publicly readable S3 bucket exposes logs to unauthorized access and tampering, undermining integrity. Option B is wrong because KMS server-side encryption protects confidentiality at rest but does not prevent an authorized user or attacker with write permissions from altering or deleting log objects. Option E is wrong because cross-region replication improves durability and availability but does not prevent tampering with the source or replicated logs.

Answer

Store logs in a publicly readable S3 bucket for transparency

Answer

Encrypt logs using server-side encryption with AWS KMS

Answer

Enable cross-region replication for logs