CCSP Cloud Security Operations Practice Test 8 — 15 Questions

Question 1

A security analyst is investigating a potential security incident in a Microsoft Azure environment. The analyst needs to review the history of role assignments and changes to Azure resources over the past 90 days. Which Azure service should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Activity Log. The Azure Activity Log is the correct service because it records subscription-level events, including role assignments and resource modifications, and retains them for 90 days. This directly matches the analyst's need to review the history of changes over that period. Other services either focus on different scopes (like Microsoft Entra ID) or require additional configuration for log retention.

Answer

Azure Monitor Logs

Answer

Azure Security Center

Answer

Azure AD Audit Logs

Question 2

A security operations team at a healthcare company running workloads on AWS needs to ensure that all API activity in their production account is recorded and retained for 12 months, with the ability to search for specific events during a forensic investigation. The compliance officer mandates that logs must be protected from deletion by any user, including administrators. Which AWS service and configuration should the team implement to meet these requirements?

Accepted Answer

Enable AWS CloudTrail with a multi-region trail, deliver logs to an S3 bucket with versioning and MFA delete enabled, and apply a bucket policy that denies deletion.. CloudTrail is the AWS service that records API activity. To meet retention and immutability, logs should be stored in S3 with versioning and MFA delete, and a bucket policy that denies deletion for all principals. This ensures logs cannot be tampered with, even by administrators, and can be queried for forensic purposes. Other services like AWS Config or VPC Flow Logs capture different data types and lack the required protection mechanisms.

Answer

Enable AWS CloudTrail with a multi-region trail, deliver logs to a CloudWatch Logs log group with a 12-month retention policy, and set up a subscription filter to S3.

Answer

Enable AWS Config to record configuration changes and deliver snapshots to an S3 bucket with a lifecycle policy to retain for 12 months.

Answer

Enable VPC Flow Logs to capture all traffic, store them in CloudWatch Logs with a 12-month retention policy, and restrict access using IAM policies.

Question 3

A healthcare company stores regulated data in Amazon S3. An auditor requires proof that objects are protected against accidental deletion or overwrite for a fixed period, and that the protection cannot be removed even by the root account. Which S3 feature should the security team implement?

Accepted Answer

S3 Object Lock in compliance mode with a retention period matching the required fixed duration.. S3 Object Lock in compliance mode creates a write-once-read-many (WORM) protection that no principal, including the root account, can bypass or shorten during the retention period. Governance mode and bucket policies are administratively changeable, and versioning alone does not prevent deletion. Compliance mode directly satisfies the immutability and fixed-duration requirements.

Answer

S3 Object Lock in governance mode with a retention period matching the required fixed duration.

Answer

A bucket policy that denies s3:DeleteObject and s3:PutObject to all principals except a dedicated backup role.

Answer

S3 Versioning with a lifecycle rule that transitions noncurrent versions to S3 Glacier Deep Archive.

Question 4

A cloud operations team manages 200 Amazon EC2 instances spread across three AWS accounts. They must continuously assess the instances for missing OS patches and misconfigured software, and they want findings aggregated in a single console with severity ratings and remediation runbooks. Which AWS service should the team deploy to meet these requirements?

Accepted Answer

Amazon Inspector. Continuous detection of missing OS patches and software misconfigurations inside EC2 instances requires a vulnerability management service with host-level visibility. Amazon Inspector uses the SSM agent to inventory packages and network reachability, assigns severity, and supports multi-account aggregation through a delegated administrator, so findings from all three accounts appear in one console with remediation runbooks.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

Amazon GuardDuty

Question 5

A financial services company uses Azure and must ensure that all administrative actions in their Azure subscription are logged and that logs are stored in an immutable storage account for 7 years. They also need to be able to alert on specific critical operations, such as deletion of a resource group. Which combination of Azure services should they implement?

Accepted Answer

Azure Monitor activity log, Azure Storage with immutable blob storage, and Azure Monitor alerts.. The Azure Monitor activity log is the source for subscription-level administrative events. To achieve immutability, logs must be exported to a storage account configured with immutable blob storage policies. Azure Monitor alerts can be set up to trigger on specific operations like resource group deletion. This trio meets logging, retention, and alerting requirements.

Answer

Azure Monitor activity log, Azure Event Hubs, and Azure Stream Analytics.

Answer

Azure Security Center (now Microsoft Defender for Cloud), Azure SQL Database auditing, and Azure Logic Apps.

Answer

Azure Log Analytics workspace, Azure Monitor alerts, and Azure Automation runbooks.

Question 6

A cloud security engineer is deploying a web application on Google Cloud Platform (GCP) and needs to protect it from common web exploits like SQL injection and cross-site scripting. The engineer wants a managed service that can be configured with security policies. Which GCP service should be used?

Accepted Answer

Google Cloud Armor. Google Cloud Armor is the correct service because it is a managed WAF that can be configured with security policies to protect against web exploits. It integrates with load balancing to filter malicious traffic. The other services provide identity control, network connectivity, or load distribution, but none offer WAF functionality.

Answer

Google Cloud Load Balancing

Answer

Google Cloud VPN

Answer

Google Cloud Identity-Aware Proxy (IAP)

Question 7

A security operations centre uses AWS CloudTrail and wants to detect when an IAM access key belonging to a privileged role is used from an unrecognized IP address outside business hours. The team already has CloudTrail management events delivered to Amazon CloudWatch Logs. Which approach best detects this behaviour with the LEAST operational overhead?

Accepted Answer

Enable Amazon GuardDuty and rely on its IAM finding types for anomalous access key usage. Detecting anomalous use of privileged access keys from unfamiliar IPs outside normal hours is a behavioural threat-detection problem. Amazon GuardDuty ingests CloudTrail management events continuously and applies anomaly detection and threat intelligence to surface findings like anomalous access key usage, requiring no custom filters or scheduled queries, which minimizes operational overhead for the SOC.

Answer

Write a CloudWatch Logs Insights query and schedule it hourly to email matching events to the security team

Answer

Create a CloudWatch Logs metric filter that matches the access key event and an alarm that triggers when the source IP is outside an allowlist

Answer

Configure an AWS Config custom rule that evaluates IAM access key metadata against approved CIDR ranges

Question 8

A security team is using AWS and wants to monitor for changes to security groups that could expose resources to the internet. They need to receive an alert when a security group rule is modified to allow inbound traffic from 0.0.0.0/0 on port 22. Which AWS service should they use to detect this change?

Accepted Answer

AWS Config. AWS Config is designed to monitor resource configurations and evaluate them against desired settings. It can detect when a security group rule is changed to allow inbound SSH from 0.0.0.0/0 and trigger an alert. The other services either log API calls without evaluation, focus on threat detection, or provide periodic checks, making them less suitable for this specific requirement.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 9

A cloud operations team is deploying a containerized workload on a managed Kubernetes service. They need to ensure that if a container image is discovered to contain a critical vulnerability, the running pods using that image are automatically replaced with a non-vulnerable version. Which mechanism BEST achieves this?

Accepted Answer

Configure an admission controller that rejects the vulnerable image tag and use a deployment strategy that replaces pods when the image tag is updated to a patched version.. Blocking the vulnerable image through an admission controller stops new pods from using it, and updating the deployment to a patched image tag triggers a rolling update that replaces existing pods. Together these enforce image policy and automatically converge the workload on the safe version, meeting the automatic replacement requirement without relying on manual intervention.

Answer

Use a network policy that isolates pods running the vulnerable image until the image is patched.

Answer

Configure a pod disruption budget that prevents pods with vulnerabilities from being evicted during maintenance windows.

Answer

Enable a runtime security agent that detects the vulnerability at runtime and sends an alert to the security team for manual remediation.

Question 10

A cloud operations team is deploying a new web application on Google Cloud Platform (GCP). They need to ensure that all incoming traffic to their Compute Engine instances is inspected for common web attacks such as SQL injection and cross-site scripting. They also want to minimize latency and management overhead. Which GCP service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the GCP service designed to protect web applications from application-layer attacks. It provides WAF rules that can block SQL injection and XSS, and it integrates with load balancing to inspect traffic at the edge. This minimizes latency and is fully managed, meeting the requirements for security and low overhead.

Answer

VPC Service Controls

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud IDS

Question 11

A company runs a regulated workload in Microsoft Azure and must retain all administrative activity logs for seven years to satisfy an auditor. The logs must be immutable and retrievable even if the original resource is deleted. Which Azure capability should the team implement?

Accepted Answer

Azure Storage immutable blob storage with a time-based retention policy. The requirement combines long retention, immutability, and availability after resource deletion. Azure Storage immutable blob storage with a locked time-based retention policy holds blobs unalterable for the configured interval, and diagnostic settings can route activity logs there. That pairing meets the seven-year immutability mandate in a way plain log retention or streaming pipelines cannot.

Answer

Azure Event Hubs streaming activity logs to a third-party SIEM

Answer

A Log Analytics workspace with a 30-day interactive retention and archive tier

Answer

Azure Monitor activity log with the default 90-day retention setting

Question 12

A cloud security team is designing a detective control strategy for a multi-account AWS organization. The team wants to continuously evaluate resource configurations against CIS AWS Foundations Benchmark controls across all accounts and receive alerts when a resource drifts from the desired state. The team also wants to automatically remediate noncompliant resources where possible. Which TWO AWS services should be combined to meet these requirements? (Choose two.)

Accepted Answer

AWS Config with conformance packs. Continuous configuration evaluation against CIS controls across an organization is delivered by AWS Config conformance packs, which package standards-mapped rules and support multi-account deployment through a delegated administrator. Automatic remediation of noncompliant resources is delivered by AWS Config remediation actions that invoke AWS Systems Manager Automation runbooks. Security Hub and Trusted Advisor provide visibility or advice but do not perform the configuration recording and automated remediation this design requires.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub with CIS AWS Foundations Benchmark standard

Answer

Amazon GuardDuty

Question 13

A cloud security team is building an incident response runbook for compromised compute instances in a public cloud. They need to preserve volatile evidence and maintain chain of custody while minimizing service disruption. Which TWO actions should be included in the runbook? (Choose two.)

Accepted Answer

Capture a memory dump of the running instance before shutting it down, storing the dump in a write-once location with a documented hash.. Preserving volatile memory before any shutdown and snapshotting persistent volumes into an isolated forensic account together capture the full evidence set while maintaining integrity. Both actions record identifiers and hashes for chain of custody, and they allow the original instance to be contained or rebuilt without losing forensic artifacts, which is the core of a defensible cloud incident response runbook.

Answer

Disable all logging on the instance to prevent the attacker from tampering with logs, then re-enable after remediation.

Answer

Immediately terminate the instance to prevent further malicious activity and rely on the cloud provider's internal logs for evidence.

Answer

Reboot the instance into safe mode to clear malicious processes, then continue using it for production traffic.

Question 14

A cloud security team must harden the management plane for a Kubernetes cluster running on Google Kubernetes Engine. They want to limit who can reach the control plane endpoint and ensure that any administrative action taken against the cluster is attributable to a named identity. (Choose two.)

Accepted Answer

Enable Cloud Audit Logs for the GKE cluster's Admin Activity and Data Access logs. Restricting control plane reachability is accomplished with authorized networks, which constrain the source CIDRs permitted to contact the API server. Attribution of administrative actions requires Cloud Audit Logs, specifically Admin Activity and Data Access logs, which record the identity and method for each call. Together they harden the management plane and provide accountability.

Answer

Enable network policy enforcement on the cluster's node pools

Answer

Use Binary Authorization to require attestations before workloads deploy

Answer

Apply PodSecurity admission with the restricted profile to all namespaces

Question 15

A company uses Microsoft Azure and wants to implement just-in-time (JIT) virtual machine access to reduce the attack surface. They need to ensure that only authorized users can access VMs on specific management ports, and that access is granted for a limited time. Which Azure service should they use?

Accepted Answer

Azure Security Center (now Microsoft Defender for Cloud) just-in-time VM access. Microsoft Defender for Cloud's just-in-time VM access is designed to reduce the attack surface by allowing access to VMs only when needed, for a limited time, and on specific ports. It uses Azure RBAC to control who can request access and NSGs to enforce the temporary rules. This meets the requirement for time-limited, authorized access.

Answer

Azure Bastion

Answer

Network security groups (NSGs) with service tags

Answer

Azure Firewall