CCSP Cloud Security Operations Practice Test 5 — 15 Questions

Question 1

A security engineer is evaluating vulnerability management options for cloud workloads and wants to identify vulnerabilities without installing agents on the operating system. Which approach should be used?

Accepted Answer

Agentless scanning using cloud API-based assessment. Option B is correct because agentless scanning leverages cloud provider APIs (e.g., AWS Systems Manager, Azure Resource Graph, GCP Cloud Asset Inventory) to assess the configuration and patch state of cloud workloads without requiring an OS-level agent. This approach directly meets the requirement of identifying vulnerabilities without installing agents on the operating system, as it reads metadata and configuration snapshots from the cloud control plane.

Answer

Network-based vulnerability scanning

Answer

Agent-based scanning using AWS Inspector

Answer

Container image scanning in a registry

Question 2

During a cloud incident response, a security team needs to collect memory from a compromised EC2 instance for forensic analysis. Which method is most appropriate for acquiring a memory dump?

Accepted Answer

Use AWS Systems Manager to run a memory acquisition script on the instance.. Taking a snapshot of the instance and then analyzing the snapshot can capture memory if the instance is not stopped; however, the best practice is to use forensic tools to capture memory before taking a snapshot. But among the options, snapshot is a valid approach to capture the state, though memory is volatile. Actually, memory dump requires live acquisition; but given the options, the most appropriate is to take a snapshot and use it for memory analysis (though not perfect). Alternatively, using AWS Systems Manager to run a memory capture script. However, typical CCSP guidance: take a snapshot of the EBS volumes, which includes the memory swap file. But the correct answer here is to use a snapshot for forensic analysis, as it captures the disk including swap. But let's think: memory dump is captured via tools like LiME; snapshot alone does not capture RAM. So perhaps the best answer is to use a tool like AWS Systems Manager to run a memory capture script. Since the question is hard and expects knowledge of forensic acquisition, the correct answer should be: Use a memory acquisition tool via Systems Manager. But options may not include that. Let's assume options include: A) Take a snapshot of the EBS volume; B) Use AWS Systems Manager to run a memory dump script; C) Use AWS CloudTrail to analyze API calls; D) Use VPC Flow Logs. The best is B. So I'll write accordingly.

Answer

Analyze CloudTrail logs for the instance's API calls.

Answer

Take a snapshot of the EBS volumes attached to the instance.

Answer

Review VPC Flow Logs for network traffic.

Question 3

An organization is using Azure and wants to ensure that all resources are compliant with CIS benchmarks. Which Azure service provides a unified view of compliance posture and recommendations?

Accepted Answer

Azure Secure Score. Azure Secure Score (now part of Microsoft Defender for Cloud) provides a unified, centralized view of an organization's security and compliance posture, including specific recommendations aligned with CIS benchmarks. It aggregates findings from Azure Policy and other security controls into a single score and actionable guidance, making it the correct service for monitoring compliance against CIS standards.

Answer

Azure Sentinel

Answer

Azure Monitor

Answer

Azure Policy

Question 4

Which of the following is a primary purpose of a SOAR (Security Orchestration, Automation and Response) platform in cloud security operations?

Accepted Answer

To automate response to security incidents by executing predefined playbooks.. SOAR platforms automate incident response processes, orchestrating actions across multiple tools and reducing manual effort.

Answer

To provide a centralized dashboard for cloud cost management.

Answer

To scan container images for vulnerabilities.

Answer

To enforce identity and access management policies.

Question 5

A security team wants to detect when the root user account is used in AWS. Which service can generate an alert for this activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including the use of the root user account. It uses machine learning and integrated threat intelligence to generate findings for such activities, which can then trigger alerts via Amazon CloudWatch Events or AWS Lambda. This makes it the correct choice for detecting root user usage.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Security Hub

Question 6

During a security incident in GCP, a forensic analyst needs to determine the exact timeline of events leading to a credential compromise. Which log source provides the most detailed information about IAM policy changes and authentication events?

Accepted Answer

Cloud Audit Logs. GCP Cloud Audit Logs record all admin activities and data access, including IAM changes and authentication, making them the best source for timeline reconstruction.

Answer

VPC Flow Logs

Answer

Cloud DNS logs

Answer

Cloud Monitoring metrics

Question 7

A security team is enhancing logging in AWS to capture detailed data events for S3 buckets. Which TWO of the following should be enabled to achieve comprehensive monitoring of S3 data access? (Choose two.)

Accepted Answer

S3 server access logs. S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. This is essential for auditing all data access events at the object level, such as GET, PUT, and DELETE operations, directly from the S3 service.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 8

An organization is designing an incident response playbook for a compromised AWS IAM user. Which THREE actions should be included in the containment phase? (Choose three.)

Accepted Answer

Disable the user's access keys.. Containment involves stopping the attacker's access. Revoking credentials, disabling the user's access keys, and attaching a deny-all policy are effective containment steps. Terminating resources is eradication, and taking snapshots is evidence collection.

Answer

Take a snapshot of all EC2 instances for forensic analysis.

Answer

Terminate any EC2 instances launched by the user.

Question 9

A company is using Azure and wants to implement cloud security posture management (CSPM) to detect misconfigurations. Which TWO services can provide CSPM capabilities? (Choose two.)

Accepted Answer

Azure Policy. Azure Policy is correct because it enforces organizational standards and assesses compliance at scale, providing CSPM capabilities by evaluating Azure resources against defined rules to detect misconfigurations. It integrates with Microsoft Defender for Cloud to offer continuous monitoring and remediation of security posture issues.

Answer

Azure Key Vault

Answer

Azure Monitor

Answer

Azure Sentinel

Question 10

A cloud security engineer needs to ensure that logs from multiple AWS accounts are centrally stored in a security account for analysis. Which TWO services can be used to aggregate logs across accounts? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription filters. Amazon CloudWatch Logs supports cross-account subscription filters, which allow you to stream log data from log groups in multiple source accounts to a single destination (e.g., a Kinesis stream or Lambda function) in a central security account. This enables real-time aggregation of logs across accounts without requiring agents in each account to send logs directly to a different destination.

Answer

AWS Config

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Question 11

An organization is using GCP and wants to implement automated remediation of security misconfigurations. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

Cloud Functions. Cloud Functions (D) is correct because it can be triggered by events from Cloud Security Command Center (Cloud SCC) to automatically remediate security misconfigurations. Cloud SCC detects vulnerabilities and misconfigurations, and Cloud Functions can execute remediation logic such as modifying IAM policies, enabling logging, or updating firewall rules. Together, they enable event-driven, automated security response without manual intervention.

Answer

Cloud Build

Answer

Cloud Audit Logs

Answer

Cloud Storage

Question 12

A security engineer is investigating a potential data exfiltration incident involving an Amazon S3 bucket. Which set of logs would provide the most relevant information to identify the source IP and API calls made to the bucket?

Accepted Answer

AWS CloudTrail data events for the S3 bucket. S3 access logs record details of requests made to an S3 bucket, including the requester's IP and the operation performed. CloudTrail data events also capture S3 API calls at the object level. VPC Flow Logs show network traffic but not API calls. CloudWatch logs could contain application logs but are not specific to S3 access.

Answer

VPC Flow Logs for the subnet where the bucket resides

Answer

AWS Config configuration history for the S3 bucket

Answer

Amazon CloudWatch Logs for the EC2 instance accessing the bucket

Question 13

A company uses AWS CloudTrail with log file validation enabled. An auditor wants to verify that a specific log file has not been tampered with. Which process should the auditor use to confirm the integrity of the CloudTrail log file?

Accepted Answer

Use the AWS CLI command 'aws cloudtrail validate-logs' which automatically verifies the digital signature and hash. CloudTrail log file validation uses SHA-256 hashing and digital signatures. The log file digest file contains the hash of the log file and is signed by a private key. To verify, the auditor uses the public key (from AWS) to verify the signature on the digest, then compares the hash of the log file to the hash in the digest.

Answer

Check the log file’s last modified timestamp against the CloudTrail delivery timestamp

Answer

Compare the log file’s SHA-256 hash with the hash stored in AWS Key Management Service (KMS)

Answer

Review the log file’s integrity using the SHA-256 checksum provided in the S3 object metadata

Question 14

An organization is implementing a cloud SIEM solution to centralize security monitoring across multiple AWS accounts. Which service should be used to aggregate security findings and send them to a third-party SIEM like Splunk?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it is designed to aggregate security findings from multiple AWS services (e.g., GuardDuty, Inspector, Macie) and AWS accounts, and then forward them to third-party SIEM solutions like Splunk via AWS EventBridge or direct integration. This centralizes security alerts into a single dashboard and stream, enabling efficient monitoring across a multi-account environment.

Answer

AWS CloudTrail

Answer

AWS GuardDuty

Answer

AWS Config

Question 15

A security analyst notices a spike in failed login attempts from an IP address in a country where the company has no operations. Which SIEM correlation rule would be most effective in detecting this type of activity?

Accepted Answer

Impossible travel – login from two geographically distant locations within minutes. An impossible travel rule detects logins from geographically distant locations within a short timeframe, which may indicate compromised credentials. The other rules address different scenarios: mass S3 download for data exfiltration, new IAM admin for privilege escalation, and root account usage for unauthorized access.

Answer

Root account usage – alert when root user performs any action

Answer

Mass S3 download – high volume of GetObject requests from a single IP

Answer

New IAM admin user creation – detection of privileged role assignment