CCSP Cloud Security Operations — Timed 15 Questions

Question 1

After a security incident involving a compromised access key, a security engineer needs to collect forensic evidence from the cloud environment. Which of the following actions would be most useful for determining the timeline of the compromise?

15 minute time limit — choose an answer to begin.

Accepted Answer

Reviewing cloud audit logs for the compromised key. Cloud audit logs contain detailed records of all API calls, including the identity, timestamp, and source IP. Analyzing these logs helps establish the timeline of when the key was used.

Answer

Taking a memory dump of the compute instance

Answer

Analyzing network flow logs for data exfiltration

Answer

Checking configuration management logs for resource changes

Question 2

A cloud security analyst is configuring a SIEM correlation rule to detect mass data exfiltration from an AWS S3 bucket. Which THREE log sources should be ingested to create an effective detection? (Choose three.)

Accepted Answer

CloudTrail data events for S3. CloudTrail data events for S3 capture object-level API operations such as GetObject, PutObject, and DeleteObject. By monitoring these events, a SIEM can detect anomalous patterns like a sudden spike in read requests from a single IP, which is a strong indicator of mass data exfiltration. This log source provides the granularity needed to identify the specific actions and actors involved in data access.

Answer

AWS Config configuration history

Answer

CloudTrail management events

Question 3

A security engineer is implementing automated incident response for common cloud threats. Which TWO cloud services can be used together to create a serverless orchestration workflow for incident response? (Choose two.)

Accepted Answer

Orchestration service for serverless workflows. An orchestration service for serverless workflows can coordinate multi-step incident response processes, and a serverless compute service can execute the individual remediation actions. Together they form a serverless incident response pipeline.

Answer

Infrastructure as code service

Answer

Virtual machine service

Answer

Vulnerability management service

Question 4

A security engineer needs to ensure that all API calls made to AWS resources are logged for auditing purposes. Which AWS service should be enabled to capture management events, data events, and provide log file validation?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to log API calls and actions taken within an AWS account, capturing management events (e.g., creating or deleting resources) and data events (e.g., S3 object-level operations). It also provides log file validation through digital signatures using SHA-256 hashing and RSA, ensuring the integrity and authenticity of the log files after they have been delivered.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS GuardDuty

Question 5

An organization is using Azure and wants to centrally collect activity logs from multiple subscriptions into a single Log Analytics workspace for cross-account analysis and retention management. What is the best approach?

Accepted Answer

Use Azure Policy to deploy Diagnostic Settings on each subscription to stream Activity Logs to a central Log Analytics workspace.. Azure Policy can enforce the deployment of Diagnostic Settings across all subscriptions, automatically streaming Activity Logs to a central Log Analytics workspace. This ensures centralized collection, cross-account analysis, and retention management without manual configuration per subscription.

Answer

Use Azure Monitor Agent on all VMs to collect logs.

Answer

Enable Azure Sentinel on each subscription and aggregate using cross-workspace queries.

Answer

Use Azure Storage account with event grid to forward logs to a central location.

Question 6

A security engineer needs to scan all container images stored in Amazon Elastic Container Registry (ECR) for vulnerabilities. The scan must be automated whenever a new image is pushed. Which solution meets this requirement?

Accepted Answer

Enable Amazon Inspector continuous scanning for ECR repositories.. Amazon Inspector continuous scanning for Amazon ECR automatically scans container images for software vulnerabilities whenever a new image is pushed to the repository. This feature is natively integrated with ECR, requires no additional infrastructure, and provides findings directly in the Inspector console and via AWS Security Hub. Option D is correct because it is the only AWS-native, automated, and fully managed solution that meets the requirement.

Answer

Use Amazon Macie for image scanning.

Answer

Configure AWS Security Hub to scan images.

Answer

Use AWS Lambda to invoke Clair on each push.

Question 7

A cloud security engineer needs to implement a solution to detect configuration drift against CIS benchmarks for AWS workloads. Which tool or service is specifically designed for cloud security posture management (CSPM) in AWS?

Accepted Answer

AWS Security Hub. AWS Security Hub is a cloud security posture management (CSPM) service that aggregates security findings from multiple AWS services and third-party tools, and it can continuously monitor AWS workloads against CIS AWS Foundations Benchmarks. It provides automated compliance checks, consolidated dashboards, and remediation guidance specifically designed for detecting configuration drift from benchmark standards.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Inspector

Question 8

An incident response playbook for a cloud environment includes containment steps. For a compromised IAM user in AWS, which action is least likely to be effective for containment?

Accepted Answer

Change the IAM user's password. Changing the IAM user's password does not invalidate existing authenticated sessions or tokens (such as temporary credentials from STS or access keys). An attacker who has already established a session or obtained access keys can continue to use them until they expire or are explicitly revoked. Therefore, password change alone is ineffective for immediate containment.

Answer

Disable the IAM user

Answer

Attach a DenyAll policy to the user

Answer

Disable the IAM user's access keys

Question 9

A security analyst notices a spike in failed login attempts from an IP address in a country where the company has no operations. Which SIEM correlation rule would be most effective in detecting this type of activity?

Accepted Answer

Mass S3 download – high volume of GetObject requests from a single IP. A mass S3 download rule detects a high volume of GetObject requests from a single IP, which aligns with the scenario of a spike in failed login attempts from a single IP. While the rule is designed for data exfiltration, it can be adapted to detect any anomalous high-volume activity from a single source, making it the most effective among the given options. Impossible travel (B) requires successful logins from distant locations, not failed attempts, and the other options address different threats.

Answer

Root account usage – alert when root user performs any action

Answer

Impossible travel – login from two geographically distant locations within minutes

Answer

New IAM admin user creation – detection of privileged role assignment

Question 10

A security engineer needs to ensure that all API calls made to cloud resources are logged for auditing. Which cloud auditing feature should be enabled to capture management and data events?

Accepted Answer

Cloud audit logging service. In cloud environments, an audit logging service is the feature designed to log API calls for auditing. It can capture management events (control plane) and data events (data plane) such as object-level operations and function invocations.

Answer

Cloud monitoring and logging service

Answer

Configuration management service

Answer

Threat detection service

Question 11

An organization is setting up a centralized logging solution across multiple accounts in their cloud environment. The security team requires that logs from all accounts be sent to a single security account, with lifecycle policies to transition logs to cheaper storage after 90 days. Which approach should be used?

Accepted Answer

Use the cloud provider's organizational structure and enable a single audit logging configuration that delivers logs to a central storage container in the management account.. For cross-account log aggregation, the cloud provider's organizational structure can be used to centrally manage audit logging. A single audit logging configuration can be enabled that delivers logs from all accounts to a central storage container in the management account. Lifecycle policies on that container can then manage transitions to lower-cost storage classes after 90 days.

Answer

Enable the cloud provider's native audit logging in each account and manually copy logs daily to the security account.

Answer

Create an audit log configuration in each account and export logs to a centralized monitoring service, then use cross-account log forwarding to a central storage container.

Answer

Use a serverless function to copy logs from each account's storage container to the central storage container.

Question 12

A security analyst is investigating a potential breach and needs to verify the integrity of audit logs stored in cloud storage. Which feature should the analyst rely on to confirm that logs have not been tampered with?

Accepted Answer

Log file integrity validation. Integrity verification of audit logs is typically achieved through cryptographic hashing (e.g., SHA-256) and digital signatures provided by the cloud service provider's logging service. This allows the analyst to confirm that logs have not been altered since they were created.

Answer

Server-side encryption of logs

Answer

Anomaly detection on logs

Answer

Immutable storage for logs

Question 13

An organization uses a cloud-based SIEM solution. Which cloud service provides native integration to stream audit logs into the SIEM?

Accepted Answer

Centralized logging service. The centralized logging service can stream audit logs directly to the SIEM via connectors. Many cloud providers offer this native integration, allowing organizations to aggregate and analyze log data centrally.

Answer

Security monitoring service

Answer

Policy management service

Answer

Recommendation service

Question 14

A SOC analyst notices an alert for 'impossible travel' where a user logged in from New York and then from London within 15 minutes. The SIEM correlation rule likely compares which log fields?

Accepted Answer

Source IP address and timestamp. Impossible travel detection typically uses sign-in logs (source IP, geolocation) and event timestamps to identify logins from distant locations within a short time.

Answer

User agent and browser type

Answer

Destination IP and port

Answer

Volume of data transferred and timestamp

Question 15

During a cloud security incident, a security team needs to isolate a compromised virtual machine instance that is performing outbound port scanning. Which containment action should be taken first?

Accepted Answer

Modify the security group to deny outbound traffic. Modifying the virtual machine's security group rules to deny all outbound traffic is a quick and reversible containment action that stops the scanning.

Answer

Terminate the virtual machine instance immediately

Answer

Create a snapshot or image of the virtual machine for analysis

Answer

Detach the virtual machine from the virtual network