CCSP Cloud Security Operations Practice Test 4 — 15 Questions

Question 1

A company uses Azure Sentinel as its SIEM. To ingest Azure Activity Logs and correlate with other data sources, which connector should be configured?

Accepted Answer

Azure Activity connector. The Azure Activity connector is specifically designed to ingest Azure Activity Logs, which contain subscription-level events such as resource creation, modification, and deletion. This connector enables Sentinel to correlate these operational logs with other data sources for comprehensive threat detection and incident response.

Answer

Office 365 connector

Answer

Azure Defender connector

Answer

Windows Security Events connector

Question 2

A security team is implementing vulnerability management in a hybrid cloud environment. They need to scan virtual machines without installing an agent. Which approach is most suitable?

Accepted Answer

Agentless scanning using cloud APIs. Agentless scanning using cloud APIs (Option B) is the correct approach because it allows the security team to scan virtual machines without installing any software on the VMs themselves. This method leverages cloud provider APIs (e.g., AWS EC2 DescribeInstances, Azure VM REST APIs) to query the hypervisor or management plane for VM configurations, patch levels, and vulnerabilities, making it ideal for hybrid cloud environments where agent deployment may be impractical or restricted.

Answer

Deploying a third-party vulnerability scanner on each VM

Answer

Agent-based scanning with AWS Inspector

Answer

Using container image scanning in registry

Question 3

A cloud security architect is designing a log aggregation strategy for a multi-account AWS environment. The security team needs to ensure logs from all accounts are stored centrally and cannot be altered. Which combination of services meets these requirements?

Accepted Answer

CloudTrail with cross-account log delivery to a central S3 bucket and enable log file validation. AWS CloudTrail supports cross-account log delivery to a central S3 bucket, and enabling log file validation uses a digest file signed with the CloudTrail private key to cryptographically verify that log files have not been modified, deleted, or tampered with since delivery. This combination ensures centralized storage and immutability, meeting the security team's requirements.

Answer

CloudWatch Logs to a centralized log group with IAM policies

Answer

S3 server access logs delivered to each account's own bucket

Answer

VPC Flow Logs to CloudWatch Logs in each account

Question 4

An organization is using GCP Security Command Center with Event Threat Detection. Which type of event is most likely to generate a finding for 'exfiltration'?

Accepted Answer

A large number of objects being downloaded from a Cloud Storage bucket. Event Threat Detection (ETD) in GCP Security Command Center monitors Cloud Storage access logs for anomalous data access patterns. A large number of object downloads from a single bucket within a short time window is a strong indicator of data exfiltration, as it matches the behavioral signature of bulk data extraction. ETD uses machine learning models trained on normal access baselines to flag such volume-based anomalies as 'exfiltration' findings.

Answer

A service account creating a new VM

Answer

A user logging in from a new IP address

Answer

A firewall rule change allowing all inbound traffic

Question 5

A cloud security analyst is investigating a potential credential compromise in AWS. Which TWO CloudTrail events would be most relevant to establishing a timeline of the compromise?

Accepted Answer

CreateAccessKey. (CreateAccessKey) is correct because the creation of a new access key pair is a strong indicator of an attacker establishing persistent programmatic access to an AWS account. This event, logged by CloudTrail as 'CreateAccessKey' in the IAM service, provides a precise timestamp for when the attacker may have generated credentials to maintain access outside of the console.

Answer

DeleteBucket

Answer

UpdateLoginProfile

Answer

DescribeInstances

Question 6

An organization is implementing automated remediation for common cloud security misconfigurations using AWS Config and Lambda. Which THREE misconfigurations can be automatically remediated using this approach?

Accepted Answer

S3 bucket with public read access. AWS Config can evaluate S3 bucket public read access against a managed rule (s3-bucket-public-read-prohibited) and trigger a Lambda function to apply a bucket policy that blocks public access. This is a common automated remediation pattern because the fix is deterministic and can be applied via the AWS SDK without manual intervention.

Answer

EC2 instance type not compliant with corporate standard

Answer

VPC with default security group allowing all traffic

Question 7

A company is deploying a SIEM solution in Azure. Which THREE data sources should be ingested to provide comprehensive visibility into the cloud environment?

Accepted Answer

Azure Activity Logs. Azure Activity Logs provide a control-plane audit trail for all resource management operations, including create, update, and delete actions, which is essential for detecting unauthorized changes. Azure Active Directory sign-in logs offer identity-level visibility into authentication attempts, helping to identify brute-force or compromised accounts. Azure Defender for Cloud alerts aggregate security findings from various services, highlighting active threats and vulnerabilities. Azure VNet Flow Logs, while useful for network traffic analysis, are not among the three most critical for comprehensive SIEM visibility; they produce high volume and cost, and are often supplemented by other sources. Azure Monitor Metrics focus on performance data rather than security events, making them less relevant for SIEM.

Answer

Azure VNet Flow Logs

Answer

Azure Monitor Metrics

Question 8

A cloud security engineer is tasked with ensuring that all API calls made to AWS resources are logged for audit purposes. Which AWS service should be enabled to capture management events such as creating or deleting EC2 instances?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to record API activity in an AWS account, including management events such as creating or deleting EC2 instances. It captures the who, what, when, and source IP for every API call, which is essential for audit logging and compliance. AWS Config, by contrast, records resource configuration changes and compliance history, not API call logs.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 9

A security analyst notices that an IAM user from a cloud account has logged in from two different countries within a span of 10 minutes. Which type of detection mechanism is most likely to flag this activity as suspicious?

Accepted Answer

A correlation rule in a SIEM. A correlation rule in a SIEM is designed to aggregate and analyze log data from multiple sources, such as cloud IAM logs, to detect anomalous patterns. The specific scenario of a user logging in from two geographically distant countries within 10 minutes is a classic example of an impossible travel time anomaly, which SIEM correlation rules are built to flag by comparing login timestamps and IP geolocation data.

Answer

A cloud configuration management database (CMDB)

Answer

A vulnerability scanner

Answer

An agent-based intrusion detection system (IDS)

Question 10

During a forensic investigation of a suspected data exfiltration incident in AWS, a security team needs to analyze network traffic to identify the destination IP addresses and volume of data transferred. Which data source is most appropriate for this analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IP addresses, ports, protocols, and the number of bytes transferred. This makes them the ideal data source for identifying the destination IP addresses and volume of data exfiltrated, as they provide per-flow byte counts and packet-level details without requiring packet capture.

Answer

AWS Config configuration history

Answer

AWS CloudTrail management events

Answer

Amazon S3 access logs

Question 11

A company uses Azure and wants to ensure that all activity log events are retained for seven years to meet compliance requirements. What is the most efficient way to implement this?

Accepted Answer

Export activity logs to an Azure Storage account and apply a lifecycle management policy to delete logs after 7 years.. Azure Monitor Activity Logs can be streamed to a storage account, and a lifecycle management policy can be applied to automatically delete logs after the required retention period.

Answer

Enable Azure Monitor and configure the activity log to be stored in a Log Analytics workspace with a retention of 7 years.

Answer

Use Azure Backup to back up activity logs and retain them for 7 years.

Answer

Configure activity logs to be sent to an Event Hub and then to a third-party archival service.

Question 12

A cloud security team wants to automatically detect and remediate S3 buckets that are publicly accessible. Which combination of AWS services can achieve this?

Accepted Answer

AWS Config and AWS Lambda. AWS Config continuously evaluates S3 bucket configurations against rules (e.g., s3-bucket-public-read-prohibited) and can trigger an AWS Lambda function via Amazon EventBridge when a non-compliant change is detected. The Lambda function then automatically applies a remediation action, such as removing the public access block or updating the bucket policy, achieving automated detection and remediation without manual intervention.

Answer

Amazon Inspector and AWS Security Hub

Answer

AWS WAF and Amazon Route 53

Answer

AWS CloudTrail and Amazon GuardDuty

Question 13

A security analyst is investigating a potential compromise of an AWS EC2 instance. Which step should be taken FIRST to contain the incident and prevent further damage?

Accepted Answer

Isolate the EC2 instance by updating the security group to deny all traffic.. The first priority in incident response is containment. Updating the security group to deny all traffic immediately isolates the EC2 instance from network communication, preventing lateral movement or data exfiltration while preserving the instance for further investigation. This aligns with the NIST SP 800-61 incident response framework, which emphasizes containment before eradication or recovery.

Answer

Terminate the EC2 instance immediately.

Answer

Take a snapshot of the instance for forensic analysis.

Answer

Disable the IAM role attached to the instance.

Question 14

An organization uses GCP and wants to detect container threats such as privilege escalation attempts within Kubernetes Engine. Which GCP service is designed specifically for this purpose?

Accepted Answer

Container Threat Detection. Container Threat Detection (CTD) is a GCP service purpose-built to identify threats within Google Kubernetes Engine (GKE) containers, including privilege escalation attempts, by analyzing runtime behavior and Kubernetes audit logs. It uses machine learning and rule-based detection to spot anomalies like container breakout, unauthorized system calls, and attempts to escalate privileges via capabilities or security contexts. This makes it the correct choice for detecting container-specific threats in GKE.

Answer

Cloud Security Scanner

Answer

Event Threat Detection

Answer

Cloud Audit Logs

Question 15

A company is implementing a SIEM solution and needs to ingest security logs from multiple AWS accounts into a centralized security account. Which AWS service can best aggregate findings from all accounts?

Accepted Answer

AWS Security Hub. AWS Security Hub can be enabled in multiple accounts and configured to send findings to a central administrator account, enabling cross-account aggregation.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS Config