CCSP Cloud Security Operations Practice Test 5 — 15 Questions

Question 1

A security engineer is implementing automated incident response for common cloud threats. Which TWO cloud services can be used together to create a serverless orchestration workflow for incident response? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Orchestration service for serverless workflows. Option A, an orchestration service for serverless workflows (such as AWS Step Functions), is correct because it provides the state-machine logic that coordinates, sequences, and branches incident-response steps without managing servers. Option B, a serverless compute service (such as AWS Lambda), is correct because it executes the actual response actions—enriching findings, isolating resources, or notifying teams—as event-driven functions invoked by the orchestration workflow. Together, A and B form a fully serverless orchestration pipeline: the workflow service defines the incident-response state machine while the compute service runs the per-step code. Option C, infrastructure as code, is for declaratively provisioning resources, not for orchestrating runtime incident-response logic. Option D, a virtual machine service, requires managing persistent instances and is not serverless. Option E, vulnerability management, identifies weaknesses but does not orchestrate or execute response workflows.

Answer

Infrastructure as code service

Answer

Virtual machine service

Answer

Vulnerability management service

Question 2

A security engineer needs to ensure that all API calls made to AWS resources are logged for auditing purposes. Which AWS service should be enabled to capture management events, data events, and provide log file validation?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to log API calls and actions taken within an AWS account, capturing management events (e.g., creating or deleting resources) and data events (e.g., S3 object-level operations). It also provides log file validation through digital signatures using SHA-256 hashing and RSA, ensuring the integrity and authenticity of the log files after they have been delivered.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS GuardDuty

Question 3

An organization is using Azure and wants to centrally collect activity logs from multiple subscriptions into a single Log Analytics workspace for cross-account analysis and retention management. What is the best approach?

Accepted Answer

Use Azure Policy to deploy Diagnostic Settings on each subscription to stream Activity Logs to a central Log Analytics workspace.. Azure Policy can enforce the deployment of Diagnostic Settings across all subscriptions, automatically streaming Activity Logs to a central Log Analytics workspace. This ensures centralized collection, cross-account analysis, and retention management without manual configuration per subscription.

Answer

Use Azure Monitor Agent on all VMs to collect logs.

Answer

Enable Azure Sentinel on each subscription and aggregate using cross-workspace queries.

Answer

Use Azure Storage account with event grid to forward logs to a central location.

Question 4

An organization wants to detect potential crypto mining activity on their AWS EC2 instances. Which AWS service uses machine learning to identify such threats?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious activity, including cryptocurrency mining (e.g., connections to known mining pools or unusual compute resource spikes). It analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS logs to identify behavioral patterns indicative of crypto mining, such as sustained outbound traffic to mining pool IPs or unusual EC2 instance launches.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Question 5

A security engineer needs to scan all container images stored in Amazon Elastic Container Registry (ECR) for vulnerabilities. The scan must be automated whenever a new image is pushed. Which solution meets this requirement?

Accepted Answer

Enable Amazon Inspector continuous scanning for ECR repositories.. Amazon Inspector continuous scanning for Amazon ECR automatically scans container images for software vulnerabilities whenever a new image is pushed to the repository. This feature is natively integrated with ECR, requires no additional infrastructure, and provides findings directly in the Inspector console and via AWS Security Hub. Option D is correct because it is the only AWS-native, automated, and fully managed solution that meets the requirement.

Answer

Use Amazon Macie for image scanning.

Answer

Configure AWS Security Hub to scan images.

Answer

Use AWS Lambda to invoke Clair on each push.

Question 6

An organization uses Azure Defender for Cloud to protect their hybrid environment. They want to receive alerts about suspicious activities on their Azure Key Vault. Which Defender plan should they enable?

Accepted Answer

Defender for Key Vault. Defender for Key Vault is the specific plan designed to provide advanced threat protection for Azure Key Vault. It monitors access patterns and operations on the vault to detect suspicious activities such as unauthorized access attempts, credential theft, or anomalous secret retrieval, and generates security alerts accordingly.

Answer

Defender for Databases

Answer

Defender for Containers

Answer

Defender for Servers

Question 7

What is the primary purpose of cloud security posture management (CSPM) tools?

Accepted Answer

To assess and improve the security configuration of cloud resources against benchmarks.. CSPM tools are designed to continuously monitor cloud environments, assess configurations against industry benchmarks (e.g., CIS, NIST, PCI DSS), and provide remediation guidance. Their primary purpose is to identify misconfigurations and compliance gaps, not to perform real-time threat detection or centralized logging.

Answer

To provide a centralized log storage solution.

Answer

To detect real-time threats like malware and intrusions.

Answer

To manage user identities and access permissions.

Question 8

A security engineer needs to automate the remediation of any S3 bucket that is publicly accessible. The solution should work within a single AWS account and not require manual intervention. Which combination of services is MOST appropriate?

Accepted Answer

AWS Config rule + AWS Lambda auto-remediation. AWS Config can continuously evaluate S3 bucket settings against a custom or managed rule (e.g., s3-bucket-public-read-prohibited). When the rule detects a noncompliant bucket, it triggers an AWS Lambda function via auto-remediation, which can modify the bucket's ACL or policy to remove public access. This combination provides fully automated, event-driven remediation without manual steps.

Answer

Amazon GuardDuty + AWS Step Functions

Answer

AWS CloudTrail + Amazon SNS

Answer

AWS Trusted Advisor + AWS Systems Manager

Question 9

An organization uses a cloud security monitoring service for threat detection. A finding indicates that a virtual machine instance is communicating with a known cryptocurrency mining pool. What type of threat does this represent?

Accepted Answer

Crypto mining on a virtual machine. A cloud security monitoring service detects threats by analyzing network traffic logs, DNS logs, and API call logs. A finding of communication with a known cryptocurrency mining pool indicates that the virtual machine instance is likely compromised and running crypto mining software, which consumes excessive compute resources and represents a malicious activity type known as crypto mining.

Answer

Reconnaissance port scanning

Answer

Ransomware activity

Answer

Compromised credentials exfiltration

Question 10

A company uses Azure Policy with remediation tasks to automatically fix non-compliant resources. Which scenario can be automatically remediated using a built-in policy?

Accepted Answer

A virtual machine missing the Log Analytics agent. The built-in Azure Policy 'Deploy Log Analytics agent to Windows VMs' includes a remediation task that automatically installs the Log Analytics agent on existing VMs that are missing it. This is a DeployIfNotExists policy effect, which triggers a remediation task to correct non-compliance without manual intervention.

Answer

A user creating a new Azure subscription

Answer

A SQL database with advanced data security disabled

Answer

A storage account with public network access enabled

Question 11

A security analyst reviews GCP Security Command Center findings and sees a high-severity alert for Event Threat Detection indicating that a service account key was used from an unexpected location. What is the best immediate action to contain the threat?

Accepted Answer

Disable the service account key. The correct immediate action is to disable the compromised service account key because Event Threat Detection has identified that the key is being used from an unexpected location, indicating potential unauthorized access. Disabling the key stops all further usage without deleting the service account or its other keys, preserving legitimate operations. This aligns with the principle of least privilege and incident response containment, as the key can later be rotated or deleted after investigation.

Answer

Create a new service account

Answer

Delete the service account

Answer

Rotate the key and monitor

Question 12

An organization ingests AWS CloudTrail logs into a centralized SIEM for correlation. They want to detect an attacker who exfiltrates data by downloading large volumes from an S3 bucket. Which SIEM correlation rule would best detect this?

Accepted Answer

Alert on high volume of GetObject requests from a single IP. Exfiltration of data from S3 typically involves a high volume of GetObject API calls from a single source IP. A SIEM correlation rule that triggers on a threshold of GetObject requests from the same IP address directly detects this anomalous download behavior, which is a key indicator of data exfiltration.

Answer

Alert on multiple failed login attempts

Answer

Alert on root account usage

Answer

Alert when a new IAM user is created

Question 13

A company uses Azure Sentinel as its SIEM. To ingest Azure Activity Logs and correlate with other data sources, which connector should be configured?

Accepted Answer

Azure Activity connector. The Azure Activity connector is specifically designed to ingest Azure Activity Logs, which contain subscription-level events such as resource creation, modification, and deletion. This connector enables Sentinel to correlate these operational logs with other data sources for comprehensive threat detection and incident response.

Answer

Office 365 connector

Answer

Azure Defender connector

Answer

Windows Security Events connector

Question 14

An incident response playbook for a cloud environment includes containment steps. For a compromised IAM user in AWS, which action is least likely to be effective for containment?

Accepted Answer

Change the IAM user's password. Changing the IAM user's password does not invalidate existing authenticated sessions or tokens (such as temporary credentials from STS or access keys). An attacker who has already established a session or obtained access keys can continue to use them until they expire or are explicitly revoked. Therefore, password change alone is ineffective for immediate containment.

Answer

Disable the IAM user

Answer

Attach a DenyAll policy to the user

Answer

Disable the IAM user's access keys

Question 15

An organization is using GCP Security Command Center with Event Threat Detection. Which type of event is most likely to generate a finding for 'exfiltration'?

Accepted Answer

A large number of objects being downloaded from a Cloud Storage bucket. Event Threat Detection (ETD) in GCP Security Command Center monitors Cloud Storage access logs for anomalous data access patterns. A large number of object downloads from a single bucket within a short time window is a strong indicator of data exfiltration, as it matches the behavioral signature of bulk data extraction. ETD uses machine learning models trained on normal access baselines to flag such volume-based anomalies as 'exfiltration' findings.

Answer

A service account creating a new VM

Answer

A user logging in from a new IP address

Answer

A firewall rule change allowing all inbound traffic