CCSP Cloud Security Operations Practice Test 6 — 15 Questions

Question 1

A cloud security engineer is tasked with ensuring that all API calls made to AWS resources are logged for audit purposes. Which AWS service should be enabled to capture management events such as creating or deleting EC2 instances?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to record API activity in an AWS account, including management events such as creating or deleting EC2 instances. It captures the who, what, when, and source IP for every API call, which is essential for audit logging and compliance. AWS Config, by contrast, records resource configuration changes and compliance history, not API call logs.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 2

A security analyst notices that an IAM user from a cloud account has logged in from two different countries within a span of 10 minutes. Which type of detection mechanism is most likely to flag this activity as suspicious?

Accepted Answer

A correlation rule in a SIEM. A correlation rule in a SIEM is designed to aggregate and analyze log data from multiple sources, such as cloud IAM logs, to detect anomalous patterns. The specific scenario of a user logging in from two geographically distant countries within 10 minutes is a classic example of an impossible travel time anomaly, which SIEM correlation rules are built to flag by comparing login timestamps and IP geolocation data.

Answer

A cloud configuration management database (CMDB)

Answer

A vulnerability scanner

Answer

An agent-based intrusion detection system (IDS)

Question 3

During a forensic investigation of a suspected data exfiltration incident in AWS, a security team needs to analyze network traffic to identify the destination IP addresses and volume of data transferred. Which data source is most appropriate for this analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IP addresses, ports, protocols, and the number of bytes transferred. This makes them the ideal data source for identifying the destination IP addresses and volume of data exfiltrated, as they provide per-flow byte counts and packet-level details without requiring packet capture.

Answer

AWS Config configuration history

Answer

AWS CloudTrail management events

Answer

Amazon S3 access logs

Question 4

A security analyst is investigating a potential compromise of an AWS EC2 instance. Which step should be taken FIRST to contain the incident and prevent further damage?

Accepted Answer

Isolate the EC2 instance by updating the security group to deny all traffic.. The first priority in incident response is containment. Updating the security group to deny all traffic immediately isolates the EC2 instance from network communication, preventing lateral movement or data exfiltration while preserving the instance for further investigation. This aligns with the NIST SP 800-61 incident response framework, which emphasizes containment before eradication or recovery.

Answer

Terminate the EC2 instance immediately.

Answer

Take a snapshot of the instance for forensic analysis.

Answer

Disable the IAM role attached to the instance.

Question 5

An organization uses GCP and wants to detect container threats such as privilege escalation attempts within Kubernetes Engine. Which GCP service is designed specifically for this purpose?

Accepted Answer

Container Threat Detection. Container Threat Detection (CTD) is a GCP service purpose-built to identify threats within Google Kubernetes Engine (GKE) containers, including privilege escalation attempts, by analyzing runtime behavior and Kubernetes audit logs. It uses machine learning and rule-based detection to spot anomalies like container breakout, unauthorized system calls, and attempts to escalate privileges via capabilities or security contexts. This makes it the correct choice for detecting container-specific threats in GKE.

Answer

Cloud Security Scanner

Answer

Event Threat Detection

Answer

Cloud Audit Logs

Question 6

A company is implementing a SIEM solution and needs to ingest security logs from multiple AWS accounts into a centralized security account. Which AWS service can best aggregate findings from all accounts?

Accepted Answer

AWS Security Hub. AWS Security Hub is purpose-built to aggregate and normalize findings from multiple AWS accounts and services (GuardDuty, Inspector, Macie, Config, Firewall Manager, and third-party tools) into a single pane of glass. Using AWS Organizations integration, a delegated administrator account can centrally view and manage findings across all member accounts, which is exactly the SIEM-ingestion pattern described.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 7

Which of the following is a benefit of enabling log file validation for cloud audit logs?

Accepted Answer

It ensures the integrity of log files by allowing you to confirm that they have not been modified.. Log file validation uses a hash-based digital signature (such as SHA-256) to create a digest file for each log file. This allows you to verify that the log files have not been tampered with, deleted, or modified after they were delivered, ensuring their integrity for forensic analysis and compliance.

Answer

It automatically deletes old log files based on a retention policy.

Answer

It encrypts log files at rest.

Answer

It compresses log files to save storage space.

Question 8

A security engineer is evaluating vulnerability management options for cloud workloads and wants to identify vulnerabilities without installing agents on the operating system. Which approach should be used?

Accepted Answer

Agentless scanning using cloud API-based assessment. Agentless scanning leverages cloud provider APIs (e.g., for configuration and asset inventory) to assess the configuration and patch state of cloud workloads without requiring an OS-level agent. This approach directly meets the requirement of identifying vulnerabilities without installing agents on the operating system, as it reads metadata and configuration snapshots from the cloud control plane.

Answer

Network-based vulnerability scanning

Answer

Agent-based scanning using a cloud-specific vulnerability scanner

Answer

Container image scanning in a registry

Question 9

During a cloud incident response, a security team needs to collect memory from a compromised EC2 instance for forensic analysis. Which method is most appropriate for acquiring a memory dump?

Accepted Answer

Use AWS Systems Manager to run a memory acquisition script on the instance.. Memory acquisition on a running EC2 instance requires executing a tool on the instance itself, and AWS Systems Manager (SSM) Run Command allows the security team to run a memory acquisition script remotely without SSH access or opening inbound ports. This preserves the volatile memory contents while maintaining an auditable, IAM-controlled execution path. It is the most appropriate method for capturing RAM from a live instance.

Answer

Analyze CloudTrail logs for the instance's API calls.

Answer

Take a snapshot of the EBS volumes attached to the instance.

Answer

Review VPC Flow Logs for network traffic.

Question 10

An organization wants to ensure that all resources are compliant with CIS benchmarks. Which cloud service provides a unified view of compliance posture and recommendations?

Accepted Answer

Cloud Security Posture Management (CSPM) tool. A cloud security posture management (CSPM) tool provides a unified, centralized view of an organization's security and compliance posture, including specific recommendations aligned with CIS benchmarks. It aggregates findings from various security controls into a single score and actionable guidance, making it the correct service for monitoring compliance against CIS standards.

Answer

Security Information and Event Management (SIEM) tool

Answer

Cloud monitoring and logging service

Answer

Policy-as-code enforcement service

Question 11

Which of the following is a primary purpose of a SOAR (Security Orchestration, Automation and Response) platform in cloud security operations?

Accepted Answer

To automate response to security incidents by executing predefined playbooks.. SOAR platforms are designed to orchestrate security tools, automate repetitive response tasks, and execute predefined playbooks that coordinate actions across multiple systems during an incident. This reduces mean time to respond (MTTR) and enables consistent, repeatable incident handling. The primary purpose is automation of incident response workflows, not cost management, vulnerability scanning, or IAM enforcement.

Answer

To provide a centralized dashboard for cloud cost management.

Answer

To scan container images for vulnerabilities.

Answer

To enforce identity and access management policies.

Question 12

During a security incident in GCP, a forensic analyst needs to determine the exact timeline of events leading to a credential compromise. Which log source provides the most detailed information about IAM policy changes and authentication events?

Accepted Answer

Cloud Audit Logs. GCP Cloud Audit Logs record all admin activities and data access, including IAM changes and authentication, making them the best source for timeline reconstruction.

Answer

VPC Flow Logs

Answer

Cloud DNS logs

Answer

Cloud Monitoring metrics

Question 13

A security team is enhancing logging in AWS to capture detailed data events for S3 buckets. Which TWO of the following should be enabled to achieve comprehensive monitoring of S3 data access? (Choose two.)

Accepted Answer

S3 server access logs. S3 server access logs (option A) are correct because they record detailed, bucket-level access requests to S3, including the requester, bucket name, request time, request action, response status, and error code, providing granular visibility into object-level data access. AWS CloudTrail data events for S3 (option B) are also correct because they capture object-level API activity such as GetObject, PutObject, and DeleteObject, which are not recorded by CloudTrail management events, thereby delivering comprehensive monitoring of S3 data access. AWS Config (option C) is not correct because it evaluates and records resource configuration changes and compliance, not individual S3 data access requests. VPC Flow Logs (option D) is not correct because it captures IP traffic metadata for network interfaces in a VPC, not S3 object-level API operations. Amazon GuardDuty (option E) is not correct because it is a threat detection service that analyzes logs and findings, but it does not itself enable the detailed S3 data event logging required here.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 14

A cloud security engineer needs to ensure that logs from multiple AWS accounts are centrally stored in a security account for analysis. Which TWO services can be used to aggregate logs across accounts? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription filters. Option A is correct because CloudWatch Logs supports cross-account subscription filters, which allow a destination account (the security account) to receive real-time log events from source accounts via a destination Logs resource policy and a subscription filter, enabling centralized log aggregation. Option D is correct because Amazon S3 with cross-account bucket policies lets multiple accounts write their logs (e.g., via PutObject permissions in the bucket policy) into a single central bucket owned by the security account, which is a common pattern for centralized log storage and analysis. Option B (AWS Config) is a configuration compliance and resource inventory service, not a cross-account log aggregation mechanism. Option C (AWS Security Hub) aggregates security findings and compliance checks across accounts, not raw logs. Option E (Amazon GuardDuty) is a threat detection service that generates findings, not a general log aggregation service.

Answer

AWS Config

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Question 15

A security engineer is investigating a potential data exfiltration incident involving an Amazon S3 bucket. Which set of logs would provide the most relevant information to identify the source IP and API calls made to the bucket?

Accepted Answer

AWS CloudTrail data events for the S3 bucket. AWS CloudTrail data events capture object-level S3 API activity such as GetObject, PutObject, and DeleteObject, including the identity and source IP of the caller. This is exactly the evidence needed to trace who accessed or exfiltrated objects from a specific bucket. Management events alone would not show object reads, so data events must be explicitly enabled for the bucket.

Answer

VPC Flow Logs for the subnet where the bucket resides

Answer

AWS Config configuration history for the S3 bucket

Answer

Amazon CloudWatch Logs for the EC2 instance accessing the bucket