CCSP Cloud Security Operations — Timed 20 Questions

Question 1

A security engineer needs to ensure that all API calls made to AWS resources are logged for auditing. Which AWS service should be enabled to capture management and data events?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service designed to log API calls for auditing. It can capture management events (control plane) and data events (data plane) such as S3 object-level operations and Lambda invocations.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS GuardDuty

Question 2

An organization is setting up a centralized logging solution across multiple AWS accounts. The security team requires that logs from all accounts be sent to a single security account, with lifecycle policies to transition logs to cheaper storage after 90 days. Which approach should be used?

Accepted Answer

Use AWS Organizations and enable a single CloudTrail trail that delivers logs to a central S3 bucket in the management account.. For cross-account log aggregation, CloudTrail can be configured to deliver logs from multiple accounts to a central S3 bucket in the security account. Lifecycle policies on that bucket can then manage transitions to lower-cost storage classes.

Answer

Enable CloudTrail in each account and manually copy logs daily to the security account.

Answer

Create a CloudTrail trail in each account and export logs to CloudWatch Logs, then cross-account subscription filter to a central S3 bucket.

Answer

Use AWS Lambda to copy logs from each account's S3 bucket to the central bucket.

Question 3

A security analyst is investigating a potential breach and needs to verify the integrity of CloudTrail logs stored in S3. Which CloudTrail feature should the analyst rely on to confirm that logs have not been tampered with?

Accepted Answer

CloudTrail log file validation. CloudTrail log file validation provides SHA-256 hashing and RSA digital signing of log files, allowing verification of integrity and authenticity.

Answer

AWS KMS encryption of logs

Answer

CloudTrail Insights events

Answer

S3 Object Lock

Question 4

An organization uses Azure Sentinel as its SIEM. Which Azure service provides native integration to stream audit logs into Sentinel?

Accepted Answer

Azure Monitor. Azure Monitor Activity Log (and other logs) can be streamed directly to Azure Sentinel via connectors. Sentinel is built on Azure Monitor and integrates natively.

Answer

Azure Security Center

Answer

Azure Policy

Answer

Azure Advisor

Question 5

A SOC analyst notices an alert for 'impossible travel' where a user logged in from New York and then from London within 15 minutes. The SIEM correlation rule likely compares which log fields?

Accepted Answer

Source IP address and timestamp. Impossible travel detection typically uses sign-in logs (source IP, geolocation) and event timestamps to identify logins from distant locations within a short time.

Answer

User agent and browser type

Answer

Destination IP and port

Answer

Volume of data transferred and timestamp

Question 6

During a cloud security incident, a security team needs to isolate a compromised EC2 instance that is performing outbound port scanning. Which containment action should be taken first?

Accepted Answer

Modify the security group to deny outbound traffic. Modifying the instance's security group to deny all outbound traffic is a quick and reversible containment action that stops the scanning.

Answer

Terminate the instance immediately

Answer

Create an AMI of the instance for analysis

Answer

Detach the instance from the VPC

Question 7

A security team needs to implement automated remediation for non-compliant resources in AWS. They want to automatically fix public S3 bucket policies. Which combination of services should be used?

Accepted Answer

AWS Config and AWS Lambda. AWS Config rules can evaluate resources, and when a rule is non-compliant, an AWS Config rule can invoke a Lambda function for remediation.

Answer

AWS CloudTrail and AWS Lambda

Answer

Amazon GuardDuty and AWS Step Functions

Answer

AWS Security Hub and Amazon Inspector

Question 8

A cloud security architect is evaluating vulnerability management solutions for a hybrid cloud environment. The team needs to scan both on-premises servers and cloud workloads without installing agents on every system. Which approach is most suitable for cloud workloads?

Accepted Answer

Agentless scanning via cloud APIs (CSPM). Agentless scanning uses cloud APIs to assess vulnerabilities without requiring an agent on each instance. This is ideal for cloud workloads where agents may not be desired.

Answer

Agent-based scanning using Amazon Inspector

Answer

Network vulnerability scanning from a remote scanner

Answer

Container image scanning only

Question 9

After a security incident involving a compromised IAM key, a security engineer needs to collect forensic evidence from the AWS environment. Which of the following actions would be most useful for determining the timeline of the compromise?

Accepted Answer

Reviewing CloudTrail events for the compromised key. CloudTrail logs contain detailed records of all API calls, including the identity, timestamp, and source IP. Analyzing these logs helps establish the timeline of when the key was used.

Answer

Taking a memory dump of the EC2 instance

Answer

Analyzing VPC Flow Logs for data exfiltration

Answer

Checking AWS Config for resource changes

Question 10

Which AWS service uses machine learning to detect threats such as crypto mining activity on EC2 instances and compromised IAM credentials?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify malicious activity.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Inspector

Question 11

An organization uses GCP and wants to monitor for threats in real-time, including detecting malicious activity from compromised service accounts. Which GCP service should be used?

Accepted Answer

Event Threat Detection. Event Threat Detection is part of GCP Security Command Center and provides real-time threat detection for IAM anomalies, including compromised service accounts.

Answer

Cloud Audit Logs

Answer

Cloud Security Scanner

Answer

Container Threat Detection

Question 12

A company uses Azure Defender for Cloud to protect its hybrid environment. Which of the following is a feature of Azure Defender that provides vulnerability assessment for virtual machines?

Accepted Answer

Defender for Servers. Azure Defender includes integrated vulnerability assessment via Qualys or Microsoft built-in scanner, available for Defender for Servers.

Answer

Azure Secure Score

Answer

Azure Policy

Answer

Azure Sentinel

Question 13

During incident response in a cloud environment, a team needs to collect evidence from a compromised EC2 instance without altering the system. Which of the following is the best method to obtain a forensic memory dump?

Accepted Answer

Take a snapshot of the root EBS volume. While memory dump is ideal, taking a snapshot of the EBS volume preserves the disk state for forensic analysis, which is part of evidence collection.

Answer

Create an AMI of the instance

Answer

Enable detailed billing reports

Answer

Use the AWS CLI to run a 'memory-dump' command

Question 14

An organization wants to implement a cloud security automation solution that can automatically remediate non-compliant resources in Azure. Which Azure service should be used to create remediation tasks?

Accepted Answer

Azure Policy. Azure Policy includes 'remediation tasks' that can automatically fix non-compliant resources, often using managed identities.

Answer

Azure Security Center

Answer

Azure Automation

Answer

Azure Logic Apps

Question 15

A security team is investigating a potential data exfiltration incident where a large volume of data was downloaded from an S3 bucket. Which log source would provide the most granular details about the S3 GET requests, including the requester identity and source IP?

Accepted Answer

S3 server access logs. S3 server access logs provide detailed records of requests made to a bucket, including requester, source IP, and objects accessed. CloudTrail data events can also log S3 operations, but S3 server access logs are more granular for this purpose.

Answer

VPC Flow Logs

Answer

AWS CloudTrail management events

Answer

Amazon CloudWatch Logs for S3

Question 16

A security architect is designing a logging strategy for a multi-cloud environment using AWS and Azure. Which TWO practices should be implemented to ensure log integrity and prevent tampering? (Choose two.)

Accepted Answer

Enable CloudTrail log file validation. Log file validation (e.g., CloudTrail log file validation) ensures cryptographic verification of log integrity. Write-once-read-many (WORM) storage, such as S3 Object Lock or Azure Immutable Blob Storage, prevents deletion or modification of logs.

Answer

Store logs in a publicly readable S3 bucket for transparency

Answer

Encrypt logs using server-side encryption with AWS KMS

Answer

Enable cross-region replication for logs

Question 17

A cloud security analyst is configuring a SIEM correlation rule to detect mass data exfiltration from an AWS S3 bucket. Which THREE log sources should be ingested to create an effective detection? (Choose three.)

Accepted Answer

CloudTrail data events for S3. CloudTrail data events for S3 capture object-level API operations such as GetObject, PutObject, and DeleteObject. By monitoring these events, a SIEM can detect anomalous patterns like a sudden spike in read requests from a single IP, which is a strong indicator of mass data exfiltration. This log source provides the granularity needed to identify the specific actions and actors involved in data access.

Answer

AWS Config configuration history

Answer

CloudTrail management events

Question 18

A security engineer is implementing automated incident response for common cloud threats. Which TWO AWS services can be used together to create a serverless orchestration workflow for incident response? (Choose two.)

Accepted Answer

AWS Step Functions. AWS Step Functions can orchestrate multi-step workflows, and AWS Lambda can execute the remediation actions. Together they form a serverless incident response pipeline.

Answer

AWS CloudFormation

Answer

Amazon EC2

Answer

Amazon Inspector

Question 19

An organization is using GCP and wants to implement cloud security posture management (CSPM) to continuously monitor configurations against the CIS Benchmark. Which TWO GCP services can be used for this purpose? (Choose two.)

Accepted Answer

Cloud Asset Inventory. Cloud Asset Inventory provides a historical view of all GCP resources and their configurations, enabling continuous monitoring against compliance frameworks like the CIS Benchmark. Security Command Center offers built-in CSPM capabilities, including automated scanning for CIS Benchmark violations and actionable recommendations to remediate misconfigurations.

Answer

Cloud VPN

Answer

Cloud Audit Logs

Answer

Cloud Functions

Question 20

During a cloud incident response, the security team needs to eradicate a malicious Lambda function that was created by an attacker. Which THREE steps should be part of the eradication process? (Choose three.)

Accepted Answer

Delete the Lambda function. Deleting the Lambda function is a direct eradication step because it removes the attacker's malicious code from the AWS environment. Once deleted, the function can no longer be invoked, and any associated execution logs or metrics will cease. This action is irreversible and ensures the attacker's foothold is eliminated.

Answer

Disable CloudTrail logging in the affected region

Answer

Place the function in a quarantine VPC