CCSP Cloud Security Operations — 50 Questions

Question 1

A cloud security engineer is troubleshooting a failure in automated backups for a production database. The backup job runs nightly but has failed for the past three nights. The logs show permission denied errors when the backup service attempts to write to the storage bucket. Which action should the engineer take first?

Accepted Answer

Check the IAM roles and bucket ACLs assigned to the service account.. The permission denied errors indicate that the service account used by the backup job lacks the necessary permissions to write to the storage bucket. Checking the IAM roles and bucket ACLs is the first logical step to identify and resolve the misconfiguration, as it directly addresses the root cause without introducing unnecessary changes or escalations.

Answer

Open a support ticket with the cloud provider for incident response.

Answer

Restart the backup service and retry the job.

Answer

Rotate the service account keys used for authentication.

Question 2

An organization is designing a cloud storage solution for highly sensitive customer data. The data must be encrypted at rest and the encryption keys must be managed by the customer, not the cloud provider. Additionally, the solution must allow granular access control based on data classification. Which combination of services should the architect recommend?

Accepted Answer

Cloud HSM for key management and a cloud storage service with object-level ACLs.. Option C is correct because Cloud HSM provides customer-managed keys for encryption at rest, ensuring the customer retains sole control over the keys. Combined with a cloud storage service that supports object-level ACLs, this allows granular access control based on data classification, meeting both requirements.

Answer

Server-side encryption with customer-managed keys and a storage bucket with bucket-level policies.

Answer

Server-side encryption with cloud-managed keys and a storage bucket with bucket-level policies.

Answer

Client-side encryption with a cloud KMS and a storage bucket with bucket-level policies.

Question 3

A company uses a cloud-based SIEM to aggregate logs from multiple sources. Recently, the SIEM stopped receiving logs from a critical application server. The server is running and the application is functioning normally. The security team has verified that the log forwarder service is running on the server and the network path to the SIEM is open. Which additional step should the team take to diagnose the issue?

Accepted Answer

Inspect the log forwarder's configuration and recent log files for errors.. Option D is correct because the most likely cause of logs not being received by the SIEM, when the server is running and the network path is open, is a misconfiguration or error within the log forwarder itself. Inspecting the forwarder's configuration (e.g., destination IP, port, protocol) and its local log files (e.g., syslog, Windows Event Forwarding logs) can reveal authentication failures, queue overflows, or parsing errors that prevent log transmission. This step directly addresses the log generation and forwarding pipeline, which is the remaining point of failure after verifying network connectivity and service status.

Answer

Check the server's CPU and memory utilization.

Answer

Review the firewall rules between the server and the SIEM.

Answer

Restart the SIEM collector service.

Question 4

Which TWO of the following are best practices for securing a cloud-based container orchestration platform?

Accepted Answer

Use minimal base images to reduce the attack surface.. Using minimal base images (e.g., Alpine or distroless images) reduces the number of installed packages and libraries, thereby shrinking the attack surface. This practice limits the potential vectors for privilege escalation or remote code execution within containers, which is a core security principle for containerized workloads in platforms like Kubernetes.

Answer

Store secrets in environment variables for ease of use.

Answer

Run containers with root privileges by default.

Answer

Disable TLS certificate validation for internal communications.

Question 5

Which THREE of the following are key considerations when designing a disaster recovery plan for a cloud-based application?

Accepted Answer

Implementing cross-region replication for critical data.. Option C is correct because cross-region replication ensures that critical data is asynchronously or synchronously copied to a geographically separate cloud region, providing resilience against regional outages. This design directly supports disaster recovery by enabling failover to a secondary site with minimal data loss, often leveraging cloud-native services like AWS S3 Cross-Region Replication or Azure Geo-Redundant Storage.

Answer

Performing manual failover testing only once a year.

Answer

Eliminating all security controls to speed up recovery.

Question 6

Which TWO of the following are valid methods for securing data at rest in a cloud storage service?

Accepted Answer

Implementing client-side encryption before uploading data.. Option B is correct because client-side encryption ensures data is encrypted before it leaves the client environment, so the cloud provider never has access to the plaintext. This is a valid method for securing data at rest in cloud storage, as the encrypted objects are stored in the service and can only be decrypted by the client holding the keys.

Answer

Disabling encryption to reduce latency.

Answer

Setting the storage bucket to public read access.

Answer

Enabling access logging for the storage bucket.

Question 7

Refer to the exhibit. A security analyst is investigating a potential unauthorized key pair creation. The CloudTrail log shows a successful CreateKeyPair event for an admin user. What additional step should the analyst take to determine if this was an authorized action?

Accepted Answer

Check the source IP address against the company's approved IP ranges.. Option D is correct because the first step in verifying whether a CreateKeyPair event was authorized is to check the source IP address against the company's approved IP ranges. CloudTrail logs include the sourceIPAddress field, which can be compared to a whitelist of administrative jump hosts or corporate VPN ranges. If the IP is outside those ranges, it strongly indicates unauthorized access, even if the user credentials were valid.

Answer

Immediately revoke all admin privileges for the user.

Answer

Review the key pair's usage to see if it was used to launch instances.

Answer

Delete the key pair immediately to prevent any misuse.

Question 8

Refer to the exhibit. A security engineer has attached the above IAM policy to a user. What is the effect of this policy?

Accepted Answer

The user can upload objects only if they specify server-side encryption with AES256.. Option D is correct because the IAM policy uses a `Condition` block with `s3:x-amz-server-side-encryption` set to `AES256`. This condition ensures that any `s3:PutObject` request must include the `x-amz-server-side-encryption` header with the value `AES256`. Without this header or with a different encryption value, the request is denied. The `Deny` effect overrides any `Allow` that might exist, so the user is forced to specify SSE-S3 (AES-256) encryption on every upload.

Answer

The user can upload objects only to the my-bucket bucket with no restrictions.

Answer

The user can upload objects only if they use customer-managed KMS keys.

Answer

The user is denied from uploading objects without encryption.

Question 9

Refer to the exhibit. A cloud administrator ran the Azure CLI command to list virtual machines. One VM shows a ProvisioningState of 'Failed'. What is the most likely cause of this state?

Accepted Answer

The VM failed to start due to a resource quota limit or configuration error.. Option C is correct because a 'ProvisioningState' of 'Failed' in Azure indicates that the VM could not be created or started due to a resource quota limit (e.g., vCPU quota exceeded) or a configuration error (e.g., invalid network interface, unsupported VM size). This state is set by the Azure Resource Manager when the deployment or update operation fails, and it persists until the underlying issue is resolved and the VM is redeployed or reconfigured.

Answer

The VM's resource group has been moved to another subscription.

Answer

The VM is in a deallocated state.

Answer

The VM was deleted by another administrator.

Question 10

A financial services company runs a critical application on a cloud infrastructure. The application consists of a web tier, an application tier, and a database tier, all deployed in a single cloud region. The database is a managed relational database service with automated backups enabled. The company's disaster recovery plan requires a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. During a recent regional outage, the primary region became unavailable for 6 hours. The company attempted to restore the database from the latest automated backup in a different region, but the restore took 5 hours due to the large database size, exceeding the RTO. Additionally, the backup was 2 hours old at the time of the outage, exceeding the RPO. The security team has also noted that the backup data is encrypted with a cloud-managed key, which may not meet future compliance requirements for customer-managed encryption keys. Which course of action should the company take to meet both the RTO and RPO objectives while also addressing the encryption requirement?

Accepted Answer

Implement cross-region read replicas with synchronous replication and enable encryption with a customer-managed key that is replicated to the disaster recovery region.. Option A is correct because cross-region read replicas with synchronous replication can provide a standby database in another region with an RPO of effectively zero (synchronous replication ensures no data loss) and an RTO measured in minutes (promote the replica to primary), meeting both the 4-hour RTO and 1-hour RPO. Using a customer-managed key (CMK) replicated to the DR region satisfies the compliance requirement for customer-managed encryption keys, as the key can be controlled and audited independently of the cloud provider.

Answer

Store the backup in a different region using cross-region copy and use a cloud HSM to manage the encryption key.

Answer

Use cross-region asynchronous replication with a separate database instance and encrypt with a cloud-managed key.

Answer

Increase the frequency of automated backups to every 30 minutes and use faster storage for the database restore process.

Question 11

A healthcare organization has deployed a cloud-based application that handles protected health information (PHI). The application runs on virtual machines in a virtual private cloud (VPC). The security team has implemented security groups to control traffic to the VMs. Recently, an external penetration test revealed that a web server VM is accessible from the internet on port 22 (SSH) from any IP address (0.0.0.0/0). The security team also discovered that the SSH key pair used for the web server was created with a weak algorithm (1024-bit RSA). The team needs to remediate these issues without causing downtime for the application. Additionally, the application logs must be sent to a centralized logging solution that is encrypted in transit and at rest. Which combination of actions should the security team take?

Accepted Answer

Restrict inbound SSH access to only a bastion host's IP address, generate a new 2048-bit RSA key pair, configure the application to send logs via TLS to a centralized logging service, and enable server-side encryption for the logging bucket.. Option A is correct because it addresses both critical vulnerabilities without downtime: restricting SSH to a bastion host's IP eliminates internet-wide exposure, and generating a new 2048-bit RSA key pair replaces the weak 1024-bit key. For logging, TLS ensures encryption in transit, and server-side encryption for the logging bucket ensures encryption at rest, meeting compliance requirements for PHI.

Answer

Implement a VPN connection for all administrative access, keep the existing key pair, and use a third-party logging tool with TLS.

Answer

Change the SSH port to a non-standard port, keep the existing key pair, and enable logging to a cloud storage bucket without encryption.

Answer

Disable SSH access entirely and use a serial console for administration, keep the existing key pair, and send logs via plaintext syslog to a logging server.

Question 12

A cloud security team is investigating a data breach in their AWS environment. The logs show that an EC2 instance with an attached IAM role was compromised. The attacker used the instance's temporary credentials to access an S3 bucket containing sensitive data. Which design change would BEST prevent this type of attack in the future?

Accepted Answer

Enable IMDSv2 with a hop limit of 1 on the EC2 instance.. Option B is correct because enabling IMDSv2 with a hop limit of 1 forces the EC2 instance to use a session-oriented method to retrieve temporary credentials from the Instance Metadata Service (IMDS). This prevents SSRF attacks or other techniques that trick the instance into leaking its IAM role credentials, as the attacker would need to be on the instance itself to obtain the token. By setting the hop limit to 1, the metadata response is not forwarded beyond the instance's network interface, blocking remote access to the credentials.

Answer

Implement a network ACL that denies all outbound traffic from the EC2 instance to the S3 service.

Answer

Restrict S3 bucket access to the EC2 instance's private IP address only.

Answer

Disable public access on the S3 bucket using a bucket policy.

Question 13

A company is migrating a critical application to the cloud and must ensure that its security operations center (SOC) can detect and respond to threats in real time. The application generates high volumes of logs. Which combination of services would provide the MOST efficient and cost-effective solution for centralized logging, analysis, and alerting?

Accepted Answer

Implement a Security Information and Event Management (SIEM) system with real-time correlation and a log management solution that auto-scales.. Option B is correct because a SIEM system with real-time correlation enables the SOC to detect threats as they occur by analyzing log data across multiple sources, while an auto-scaling log management solution ensures cost efficiency by dynamically adjusting resources to handle high log volumes without over-provisioning. This combination provides centralized logging, real-time analysis, and alerting, meeting the requirement for efficient and cost-effective threat detection.

Answer

Deploy a basic monitoring tool that triggers alerts based on static thresholds.

Answer

Use a cloud-native log storage service with long retention and no analysis.

Answer

Store logs in a centralized log server and have SOC analysts manually review them.

Question 14

During a cloud security audit, it is discovered that a cloud storage bucket is configured to allow access from any IP address. The bucket contains sensitive customer data. What is the BEST immediate action to secure the bucket?

Accepted Answer

Modify the bucket policy to deny access from all IP addresses except trusted ranges.. The immediate risk is that the bucket is publicly accessible from any IP address, exposing sensitive customer data. Modifying the bucket policy to deny access from all IP addresses except trusted ranges directly addresses this exposure by restricting network-level access. This is the most effective first step because it removes the broad, unrestricted access while maintaining necessary access for authorized users.

Answer

Enable bucket logging to track access attempts.

Answer

Notify the security team and wait for a formal change request.

Answer

Enable server-side encryption on the bucket.

Question 15

A cloud security engineer is tasked with automating the response to a detected malware infection on a virtual machine. The engineer wants to isolate the VM from the network immediately upon detection. Which cloud-native feature should be used?

Accepted Answer

Modify the VM's security group to deny all inbound and outbound traffic.. Modifying the VM's security group to deny all inbound and outbound traffic is the correct cloud-native method to immediately isolate the VM from the network. Security groups act as a virtual firewall at the instance level, and by removing all allow rules, you effectively block all traffic to and from the VM, containing the malware without deleting or powering off the instance.

Answer

Take a snapshot of the VM for forensic analysis.

Answer

Attach the VM to a different load balancer.

Answer

Create a site-to-site VPN connection for the VM.

Question 16

Which TWO of the following are key components of a cloud incident response plan that should be tested regularly?

Accepted Answer

Automation playbooks for containment and eradication.. Automation playbooks for containment and eradication (B) are critical because they enable rapid, consistent response to incidents in cloud environments, where manual intervention can be too slow to prevent lateral movement or data exfiltration. Regular testing ensures these playbooks execute correctly against live cloud APIs (e.g., AWS Lambda, Azure Automation) and that they properly isolate compromised resources without disrupting legitimate workloads.

Answer

Encryption key management procedures.

Answer

Backup and restore procedures.

Answer

Service level agreements (SLAs) with cloud provider.

Question 17

Refer to the exhibit. A cloud security analyst reviews the bucket policy for example-bucket. Based on the policy, which of the following is true?

Accepted Answer

Requests from IP 192.0.2.10 over HTTPS are allowed.. Option A is correct because the bucket policy includes an explicit Allow statement granting s3:GetObject to all principals (Principal: "*") from the IP address 192.0.2.10, and the condition "Bool": {"aws:SecureTransport": "true"} ensures that only HTTPS requests are allowed. Since the request originates from the specified IP and uses HTTPS, it satisfies both the Allow condition and is not blocked by the Deny statement, which only denies requests when SecureTransport is false (i.e., HTTP). Thus, the request is permitted.

Answer

Access is denied because the Principal is set to "*", which is insecure.

Answer

Requests from IP 192.0.2.10 over HTTP are allowed because the deny statement only applies when SecureTransport is false.

Answer

Any IP address can perform GetObject requests if they use HTTPS.

Question 18

A multinational corporation runs its critical applications on a cloud platform. The security team has implemented a Security Information and Event Management (SIEM) solution that collects logs from various cloud services, including virtual machines, storage, and databases. The SIEM is configured to generate alerts based on predefined rules. Recently, the team noticed an increase in false positive alerts, causing alert fatigue among the analysts. Additionally, there is a lack of context in the alerts, making it difficult to triage and prioritize incidents. The team wants to improve the efficiency of the SOC without increasing headcount. Which of the following is the BEST course of action to address these issues?

Accepted Answer

Deploy a user and entity behavior analytics (UEBA) tool to baseline normal behavior and generate alerts based on anomalies.. UEBA uses machine learning to establish baselines of normal user and entity behavior, then generates alerts only when deviations occur. This directly reduces false positives by filtering out benign anomalies and enriches alerts with behavioral context, enabling analysts to triage and prioritize incidents more efficiently without increasing headcount.

Answer

Assign more analysts to manually review and tune the alert rules.

Answer

Implement automated response playbooks for the most common alerts to reduce analyst workload.

Answer

Increase the threshold levels for all alert rules to reduce the number of alerts generated.

Answer

Create additional correlation rules to capture more specific attack patterns.

Question 19

A company's security team is investigating an anomalous spike in outbound traffic from a cloud workload. The workload is a web server running in an IaaS environment. The team suspects data exfiltration. Which of the following is the BEST initial step to identify the source and type of traffic?

Accepted Answer

Enable VPC flow logs for the subnet hosting the workload and analyze the logs.. Option D is correct because VPC flow logs capture metadata about all IP traffic to and from network interfaces in a subnet, including source/destination IPs, ports, protocols, and packet/byte counts. Analyzing these logs allows the security team to identify the external destination IPs and ports involved in the anomalous outbound traffic, which is the fastest way to pinpoint the source workload and characterize the exfiltration pattern without disrupting service or requiring agent deployment.

Answer

Immediately isolate the workload by blocking all outbound traffic in the security group.

Answer

Deploy a host-based intrusion detection system (HIDS) agent on the workload.

Answer

Run a vulnerability scanner against the workload to identify possible entry points.

Question 20

A cloud security architect is designing a secure CI/CD pipeline for a containerized application deployed on a Kubernetes cluster. The pipeline must ensure that only approved images are deployed. Which TWO of the following controls should be implemented? (Choose two.)

Accepted Answer

Configure the Kubernetes admission controller to reject pods that use unsigned images.. Option B is correct because Kubernetes admission controllers can enforce policies such as rejecting pods that use unsigned images, ensuring only images with verified signatures are deployed. This directly addresses the requirement to deploy only approved images by validating image integrity at admission time.

Answer

Implement role-based access control (RBAC) to restrict who can push images to the registry.

Answer

Use network policies to restrict pod-to-pod communication.

Answer

Scan all container images for vulnerabilities in the CI pipeline.