CCSP Cloud Security Operations Practice Test 7 — 15 Questions

Question 1

An organization is implementing a cloud SIEM solution to centralize security monitoring across multiple AWS accounts. Which service should be used to aggregate security findings and send them to a third-party SIEM like Splunk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it is designed to aggregate security findings from multiple AWS services (e.g., GuardDuty, Inspector, Macie) and AWS accounts, and then forward them to third-party SIEM solutions like Splunk via AWS EventBridge or direct integration. This centralizes security alerts into a single dashboard and stream, enabling efficient monitoring across a multi-account environment.

Answer

AWS CloudTrail

Answer

AWS GuardDuty

Answer

AWS Config

Question 2

A cloud security team wants to automatically remediate misconfigured S3 buckets that are publicly accessible. Which combination of AWS services can be used to detect and automatically fix this issue?

Accepted Answer

AWS Config and AWS Lambda. AWS Config continuously monitors and records resource configurations, including S3 bucket policies and ACLs, and can evaluate them against desired rules. When a bucket is found to be publicly accessible, AWS Config can trigger an AWS Lambda function to automatically remediate the misconfiguration, such as by applying a restrictive bucket policy or blocking public access. This combination provides detection and automated remediation.

Answer

AWS GuardDuty and AWS Lambda

Answer

AWS CloudTrail and AWS Lambda

Answer

AWS Security Hub and AWS CloudTrail

Question 3

An organization is using GCP and wants to collect audit logs for all API calls made within the project. Which GCP service should be enabled to capture these logs?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs is the correct GCP service because it automatically records API calls and administrative activities within a GCP project. It captures Admin Activity, Data Access, System Event, and Policy Denied logs, providing a comprehensive audit trail of who did what, where, and when. This is essential for security, compliance, and forensic investigations.

Answer

VPC Flow Logs

Answer

Cloud Monitoring

Answer

Cloud Security Command Center

Question 4

A cloud operations team runs a fleet of Amazon EC2 instances behind an Application Load Balancer. After a recent penetration test, the team must ensure that only HTTP and HTTPS traffic reaches the instances from the load balancer, and that no instance can accept SSH from the internet. The instances currently have a security group named 'web-sg' that allows all inbound traffic from 0.0.0.0/0. Which action should the team take to meet these requirements with the LEAST administrative effort while following AWS best practices?

Accepted Answer

Modify the 'web-sg' security group to allow inbound HTTP and HTTPS from the load balancer's security group, and remove all other inbound rules.. Referencing the load balancer's security group in the instance security group is the most precise and least-effort method to restrict inbound traffic to only the load balancer. It leverages AWS security group referencing, which is stateful and supports least privilege without needing CIDR calculations. Removing all other inbound rules ensures no direct internet SSH access, satisfying both requirements.

Answer

Keep the existing 'web-sg' rules but configure the load balancer to use a target group that only forwards traffic on ports 80 and 443, and enable connection draining.

Answer

Replace the 'web-sg' security group with a new security group that allows inbound HTTP and HTTPS from 0.0.0.0/0, and add a rule to deny SSH from 0.0.0.0/0.

Answer

Create a new network ACL that allows inbound HTTP and HTTPS from the load balancer subnet and denies all other traffic, then associate it with the instance subnets.

Question 5

A cloud operations team runs a Kubernetes cluster on Google Kubernetes Engine (GKE). A recent audit found that several pods were scheduled onto nodes that do not meet the organization's hardened baseline, and the team wants to enforce that only nodes with specific labels are eligible for certain workloads. Which Kubernetes mechanism should the team implement?

Accepted Answer

Node affinity combined with node labels. Node affinity uses node labels as hard or soft match rules in the pod specification, so requiring a specific label ensures the scheduler only places the workload on nodes that carry the hardened baseline. This is the native Kubernetes control for constraining placement without replacing the default scheduler or altering cluster autoscaling behavior.

Answer

PodDisruptionBudget

Answer

Horizontal Pod Autoscaler

Answer

NetworkPolicy

Question 6

A financial services company stores regulated data in Amazon S3 and must prove to auditors that objects cannot be deleted or overwritten for seven years, even by a compromised root account. The security team needs the strongest native control that preserves the data for the retention period. Which S3 feature should they enable?

Accepted Answer

S3 Object Lock in compliance mode. S3 Object Lock in compliance mode enforces a write-once-read-many retention that no principal, including the account root, can shorten or remove before the retention date. Versioning and replication improve durability and recoverability but remain mutable by privileged users, so only compliance-mode Object Lock satisfies the immutability proof the auditors demand.

Answer

S3 Cross-Region Replication to a second bucket

Answer

Bucket policies that deny s3:DeleteObject to all principals

Answer

S3 Versioning with a lifecycle rule to transition objects to S3 Glacier Deep Archive

Question 7

A cloud security operations team is configuring AWS Security Hub to automatically send all findings to a third-party ticketing system. They need a solution that requires minimal custom code and supports filtering by severity. Which AWS service should they use to route the findings?

Accepted Answer

Amazon EventBridge. EventBridge natively integrates with Security Hub, allowing findings to be matched against event patterns and routed to targets. This enables severity-based filtering and delivery to external systems with minimal custom code, making it the ideal choice for automated ticketing integration.

Answer

AWS CloudTrail

Answer

Amazon SNS

Answer

AWS Config

Question 8

A cloud security engineer needs to review who created or modified IAM policies in an Azure subscription over the past 90 days, and must retain that evidence for compliance. Which Azure-native capability should be used to collect and store these records?

Accepted Answer

Azure Activity Log with a diagnostic setting to a Log Analytics workspace. The Azure Activity Log is the subscription's control-plane audit record and captures write operations such as role assignment and policy edits along with the calling identity. Exporting it via a diagnostic setting to a Log Analytics workspace provides queryable, retainable evidence, which is exactly what is needed to review IAM changes over 90 days.

Answer

Microsoft Defender for Cloud secure score

Answer

Azure Policy compliance reports

Answer

Azure Monitor metrics

Question 9

A cloud operations team at a healthcare company runs a multi-account AWS organization. Compliance requires that all Amazon S3 server access logs and AWS CloudTrail management events are retained for 7 years and cannot be altered or deleted by any account administrator, including the account that owns the bucket. The security architect must design a storage solution that enforces write-once-read-many (WORM) immutability at the storage layer. Which approach BEST satisfies these requirements?

Accepted Answer

Configure an S3 bucket with S3 Object Lock in compliance mode and a default retention period of 7 years, then centralize logs into that bucket.. The scenario demands storage-layer immutability that survives even privileged administrators and enforces a fixed 7-year retention. S3 Object Lock in compliance mode is the only mechanism here that makes object versions unalterable and undeletable for the retention period, and a default retention rule automates the 7-year window for all ingested logs. Encryption, versioning, replication, and bucket policies govern access or durability but do not deliver WORM guarantees.

Answer

Replicate logs to a second S3 bucket in a different Region using S3 Cross-Region Replication and apply a restrictive bucket policy on the replica.

Answer

Enable S3 Versioning and a bucket policy that denies s3:DeleteObject for all principals except the organization's root user.

Answer

Store logs in an S3 bucket encrypted with AWS KMS customer managed keys and rotate the keys every 90 days.

Question 10

A security operations center (SOC) uses AWS GuardDuty and wants to automatically isolate an Amazon EC2 instance that generates a high-severity finding. The isolation must block all network traffic except for forensic analysis traffic from a specific security subnet. Which combination of actions should be taken?

Accepted Answer

Modify the instance's security group to allow only traffic from the forensic subnet and remove all other rules.. The most effective and least disruptive method to isolate an EC2 instance is to modify its security group to allow only traffic from a specific forensic subnet and remove all other rules. This blocks all other network traffic while enabling forensic analysis, and it can be automated via Lambda triggered by GuardDuty findings.

Answer

Detach the instance's Elastic Network Interface (ENI) and attach a new ENI with a restrictive security group.

Answer

Move the instance to a new subnet with a network ACL that denies all traffic except from the forensic subnet.

Answer

Apply a new IAM role to the instance that denies all network access.

Question 11

A cloud security team is building an incident response runbook for workloads on AWS. They need to ensure that when a compromised EC2 instance is detected, responders can preserve volatile evidence and prevent further malicious activity without destroying forensic artifacts. (Choose two.)

Accepted Answer

Capture an EBS snapshot of the instance's volumes before making changes.. Effective cloud incident response follows the order of containment and preservation before remediation. Isolating the instance with a restrictive security group stops command-and-control and lateral movement while keeping the system alive, and capturing EBS snapshots first preserves disk artifacts. Together these steps contain the threat without destroying the evidence responders need.

Answer

Reboot the instance to clear any malicious processes from memory.

Answer

Terminate the instance immediately to stop the attacker.

Answer

Detach the root volume and attach it to an analysis instance without snapshotting first.

Question 12

A cloud operations team runs a mission-critical application on Amazon EC2 instances behind an Application Load Balancer. The security policy requires that the instances be patched monthly, but the team wants to minimize downtime and avoid manual patching. They decide to use AWS Systems Manager Patch Manager. Which configuration should they implement to meet the patching requirement while maintaining availability?

Accepted Answer

Create a patch baseline, a maintenance window that targets the instances, and a patch group that associates the instances with the baseline.. Patch Manager simplifies patching by using patch baselines, patch groups, and maintenance windows. The baseline defines which patches are approved, the patch group associates instances with the baseline, and the maintenance window schedules the patching. This integrated approach automates patching, provides compliance visibility, and allows controlled rollout to maintain availability.

Answer

Use AWS Config rules to automatically apply patches when a new CVE is published, and configure an SNS topic to notify the team.

Answer

Enable automatic OS updates on the EC2 instances by configuring the operating system's update service to run daily.

Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to run yum update on each instance via AWS Systems Manager Run Command on a schedule.

Question 13

A cloud security team is implementing a centralized logging solution for AWS. They need to ensure that all API activity in their production account is logged and that the logs are stored immutably for 7 years to meet compliance requirements. Which service should they use to capture the API activity?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in an AWS account, making it the correct choice for capturing all API calls. It integrates with Amazon S3, where logs can be stored with Object Lock to enforce immutability for compliance. The other services either focus on resource configuration, network traffic, or application logs, and cannot provide the comprehensive API auditing required.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Question 14

A cloud security team needs to ensure that all AWS API activity across a multi-account organization is captured in a tamper-evident, immutable log that can be queried later for forensic analysis. The organization uses AWS Organizations with a dedicated security account. Which approach BEST meets these requirements?

Accepted Answer

Enable AWS CloudTrail as an organization trail that delivers logs to a centralized S3 bucket with S3 Object Lock in compliance mode and validate log file integrity.. Centralized, tamper-evident API logging in AWS Organizations is achieved with an organization trail that aggregates events into a single S3 bucket. S3 Object Lock in compliance mode prevents anyone, including the root user, from deleting or overwriting objects for the retention period, while CloudTrail log file integrity validation uses digest files to prove logs were not altered, which is essential for forensic admissibility.

Answer

Configure each member account to send AWS CloudTrail events to a local CloudWatch Logs group and rely on the default 90-day retention.

Answer

Use AWS Config to record configuration changes across accounts and store the configuration history in the security account for later retrieval.

Answer

Enable Amazon GuardDuty in the security account and export its findings to an S3 bucket with versioning enabled for long-term storage.

Question 15

A cloud operations team runs a production Kubernetes cluster on Amazon EKS. During a security review, they discover that the cluster's control plane audit logs are not being captured, preventing investigation of suspicious API server activity. The team must enable audit logging with the least operational overhead while retaining logs for 90 days. Which action should they take?

Accepted Answer

Modify the EKS cluster configuration to enable control plane logging for the 'audit' log type, and configure a CloudWatch Logs retention policy of 90 days on the resulting log group.. The native way to capture Kubernetes API server audit events on EKS is to enable the 'audit' control plane log type on the cluster, which streams events to CloudWatch Logs. Setting a retention policy of 90 days satisfies the retention requirement without deploying agents or managing additional infrastructure. Node-based collection and CloudTrail do not capture control plane audit data.

Answer

Install the Amazon CloudWatch agent on each worker node and configure it to tail the kubelet and container runtime logs, then set a 90-day retention policy on the log group.

Answer

Enable AWS CloudTrail data events for the EKS cluster and set a 90-day retention period in the S3 bucket that receives the trails.

Answer

Deploy a DaemonSet that runs a Fluent Bit container on every node to collect /var/log/kube-apiserver/audit.log and forward it to CloudWatch Logs.