CCSP Cloud Security Operations — Timed 10 Questions

Question 1

After a security incident involving a compromised access key, a security engineer needs to collect forensic evidence from the cloud environment. Which of the following actions would be most useful for determining the timeline of the compromise?

10 minute time limit — choose an answer to begin.

Accepted Answer

Reviewing cloud audit logs for the compromised key. Cloud audit logs contain detailed records of all API calls, including the identity, timestamp, and source IP. Analyzing these logs helps establish the timeline of when the key was used.

Answer

Taking a memory dump of the compute instance

Answer

Analyzing network flow logs for data exfiltration

Answer

Checking configuration management logs for resource changes

Question 2

A cloud security analyst is configuring a SIEM correlation rule to detect mass data exfiltration from an AWS S3 bucket. Which THREE log sources should be ingested to create an effective detection? (Choose three.)

Accepted Answer

CloudTrail data events for S3. CloudTrail data events for S3 capture object-level API operations such as GetObject, PutObject, and DeleteObject. By monitoring these events, a SIEM can detect anomalous patterns like a sudden spike in read requests from a single IP, which is a strong indicator of mass data exfiltration. This log source provides the granularity needed to identify the specific actions and actors involved in data access.

Answer

AWS Config configuration history

Answer

CloudTrail management events

Question 3

A security engineer is implementing automated incident response for common cloud threats. Which TWO cloud services can be used together to create a serverless orchestration workflow for incident response? (Choose two.)

Accepted Answer

Orchestration service for serverless workflows. An orchestration service for serverless workflows can coordinate multi-step incident response processes, and a serverless compute service can execute the individual remediation actions. Together they form a serverless incident response pipeline.

Answer

Infrastructure as code service

Answer

Virtual machine service

Answer

Vulnerability management service

Question 4

A security engineer needs to ensure that all API calls made to AWS resources are logged for auditing purposes. Which AWS service should be enabled to capture management events, data events, and provide log file validation?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to log API calls and actions taken within an AWS account, capturing management events (e.g., creating or deleting resources) and data events (e.g., S3 object-level operations). It also provides log file validation through digital signatures using SHA-256 hashing and RSA, ensuring the integrity and authenticity of the log files after they have been delivered.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS GuardDuty

Question 5

An organization is using Azure and wants to centrally collect activity logs from multiple subscriptions into a single Log Analytics workspace for cross-account analysis and retention management. What is the best approach?

Accepted Answer

Use Azure Policy to deploy Diagnostic Settings on each subscription to stream Activity Logs to a central Log Analytics workspace.. Azure Policy can enforce the deployment of Diagnostic Settings across all subscriptions, automatically streaming Activity Logs to a central Log Analytics workspace. This ensures centralized collection, cross-account analysis, and retention management without manual configuration per subscription.

Answer

Use Azure Monitor Agent on all VMs to collect logs.

Answer

Enable Azure Sentinel on each subscription and aggregate using cross-workspace queries.

Answer

Use Azure Storage account with event grid to forward logs to a central location.

Question 6

A security engineer needs to scan all container images stored in Amazon Elastic Container Registry (ECR) for vulnerabilities. The scan must be automated whenever a new image is pushed. Which solution meets this requirement?

Accepted Answer

Enable Amazon Inspector continuous scanning for ECR repositories.. Amazon Inspector continuous scanning for Amazon ECR automatically scans container images for software vulnerabilities whenever a new image is pushed to the repository. This feature is natively integrated with ECR, requires no additional infrastructure, and provides findings directly in the Inspector console and via AWS Security Hub. Option D is correct because it is the only AWS-native, automated, and fully managed solution that meets the requirement.

Answer

Use Amazon Macie for image scanning.

Answer

Configure AWS Security Hub to scan images.

Answer

Use AWS Lambda to invoke Clair on each push.

Question 7

A cloud security engineer needs to implement a solution to detect configuration drift against CIS benchmarks for AWS workloads. Which tool or service is specifically designed for cloud security posture management (CSPM) in AWS?

Accepted Answer

AWS Security Hub. AWS Security Hub is a cloud security posture management (CSPM) service that aggregates security findings from multiple AWS services and third-party tools, and it can continuously monitor AWS workloads against CIS AWS Foundations Benchmarks. It provides automated compliance checks, consolidated dashboards, and remediation guidance specifically designed for detecting configuration drift from benchmark standards.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Inspector

Question 8

An incident response playbook for a cloud environment includes containment steps. For a compromised IAM user in AWS, which action is least likely to be effective for containment?

Accepted Answer

Change the IAM user's password. Changing the IAM user's password does not invalidate existing authenticated sessions or tokens (such as temporary credentials from STS or access keys). An attacker who has already established a session or obtained access keys can continue to use them until they expire or are explicitly revoked. Therefore, password change alone is ineffective for immediate containment.

Answer

Disable the IAM user

Answer

Attach a DenyAll policy to the user

Answer

Disable the IAM user's access keys

Question 9

A security analyst notices a spike in failed login attempts from an IP address in a country where the company has no operations. Which SIEM correlation rule would be most effective in detecting this type of activity?

Accepted Answer

Mass S3 download – high volume of GetObject requests from a single IP. A mass S3 download rule detects a high volume of GetObject requests from a single IP, which aligns with the scenario of a spike in failed login attempts from a single IP. While the rule is designed for data exfiltration, it can be adapted to detect any anomalous high-volume activity from a single source, making it the most effective among the given options. Impossible travel (B) requires successful logins from distant locations, not failed attempts, and the other options address different threats.

Answer

Root account usage – alert when root user performs any action

Answer

Impossible travel – login from two geographically distant locations within minutes

Answer

New IAM admin user creation – detection of privileged role assignment

Question 10

A security engineer needs to ensure that all API calls made to cloud resources are logged for auditing. Which cloud auditing feature should be enabled to capture management and data events?

Accepted Answer

Cloud audit logging service. In cloud environments, an audit logging service is the feature designed to log API calls for auditing. It can capture management events (control plane) and data events (data plane) such as object-level operations and function invocations.

Answer

Cloud monitoring and logging service

Answer

Configuration management service

Answer

Threat detection service