CCSP Cloud Security Operations Practice Test 4 — 15 Questions

Question 1

A cloud security engineer is investigating a potential data breach in a cloud environment. The organization uses a cloud access security broker (CASB) and has deployed a security information and event management (SIEM) system. Which of the following are likely indicators that the CASB has detected unauthorized data exfiltration? (Choose two.)

Accepted Answer

Anomalous spike in outbound traffic to an unknown IP address. CASBs are designed to detect anomalous data movements. An anomalous spike in outbound traffic to an unknown IP (A) and a large number of file downloads by a single user outside business hours (C) are strong indicators of exfiltration. Multiple failed logins (B) indicate brute force attempts, not exfiltration. Malware in email (D) is a malware indicator, not exfiltration. Firewall rule change (E) is a configuration change, not a direct exfiltration sign.

Answer

A change in the configuration of a firewall rule

Answer

Multiple failed login attempts to a critical application

Answer

An alert for a known malware signature in an email attachment

Question 2

A security analyst reviews the bucket policy above. What is the primary security concern?

Accepted Answer

The bucket policy allows public read access to all objects. Option A is correct because the bucket policy grants public read access to all objects via a Principal set to '*' and an Effect of 'Allow' on the s3:GetObject action. This means any unauthenticated user on the internet can list and download objects in the bucket, leading to potential data exposure. The primary security concern is unauthorized data disclosure, which violates the principle of least privilege.

Answer

The bucket policy uses an outdated version

Answer

The bucket policy is missing a Condition element

Answer

The bucket policy allows public write access to all objects

Question 3

The security team notices that the request above is from a known malicious IP address. However, the load balancer did not block it. What is the most likely reason?

Accepted Answer

The load balancer's access control list does not include the IP address. C is correct because a load balancer's access control list (ACL) is a stateless or stateful rule set that explicitly defines which source IP addresses are allowed or denied. If the malicious IP address is not listed in the ACL, the load balancer will not block the traffic, regardless of the request's content or encryption status. The security team's observation that the request was from a known malicious IP but was not blocked directly points to a missing or incomplete ACL entry.

Answer

The user-agent indicates it is a legitimate search engine

Answer

The response code indicates success

Answer

The request was encrypted with TLS

Question 4

A cloud security engineer reviews the Terraform configuration above. Which of the following is a security best practice that has been violated?

Accepted Answer

The security group allows unrestricted inbound traffic on port 80. Option A is correct because the security group allows unrestricted inbound traffic on port 80 from any source (0.0.0.0/0), violating the principle of least privilege. Option B (public AMI) is not necessarily a violation. Option C (plain text user_data) is a minor concern but not a best practice violation per se; secrets should not be in user_data. Option D (no SSH access) is acceptable if not needed.

Answer

The user_data script should not be in plain text

Answer

The security group does not allow SSH access

Answer

The instance uses a public AMI

Question 5

A cloud security administrator needs to ensure that all API calls to the cloud provider's management plane are logged for audit purposes. Which service should be enabled?

Accepted Answer

Cloud audit logging service. Option C is correct because the cloud audit logging service (e.g., AWS CloudTrail) records API calls for auditing. Option A (monitoring) focuses on performance metrics. Option B (configuration) tracks resource changes but not all API calls. Option D (threat detection) is for security threats.

Answer

Cloud configuration service

Answer

Cloud threat detection service

Answer

Cloud monitoring service

Question 6

A cloud operations team is setting up a new virtual network in the cloud. They need to segment traffic between different tiers of an application (web, application, database). Which security control should they implement?

Accepted Answer

Network access control lists and security groups. Option D is correct because network access control lists (NACLs) and security groups provide network segmentation by controlling traffic between tiers. Option A (IDS) detects threats but does not control traffic. Option B (WAF) protects web applications at layer 7. Option C (DLP) prevents data loss.

Answer

Intrusion detection system

Answer

Data loss prevention

Answer

Web application firewall

Question 7

A company has deployed a mission-critical application in the cloud and needs to ensure that it remains available even if an entire cloud region fails. Which architecture pattern should they adopt?

Accepted Answer

Active-passive across regions. Option C is correct because an active-passive across-regions architecture provides disaster recovery for region failure. Option A (vertical scaling) increases capacity in the same region. Option B (horizontal scaling within a single AZ) does not protect against region failure. Option D (backups) is not a high-availability pattern.

Answer

Regular backups to a different region

Answer

Vertical scaling within a single region

Answer

Horizontal scaling within a single availability zone

Question 8

A security analyst is using a cloud security posture management (CSPM) tool that reports a finding of "storage bucket publicly accessible." However, upon manual inspection, the bucket's ACL and bucket policy both restrict access to authorized users only. What is the most likely cause of the false positive?

Accepted Answer

The bucket contains objects with public ACLs. Option D is correct because individual objects within the bucket might have public ACLs, which CSPM might detect. Option A (CSPM misconfigured) is possible but less likely. Option B (policy syntax error) would cause error, not public access. Option C (region mismatch) is irrelevant.

Answer

The bucket is in a different region

Answer

The bucket policy has a syntax error

Answer

The CSPM tool is misconfigured

Question 9

An organization uses a cloud key management service (KMS) to encrypt data at rest. The security policy requires that the encryption keys be rotated every 90 days. The operations team is concerned about the impact of key rotation on encrypted data. Which of the following statements is true regarding KMS key rotation?

Accepted Answer

Data encrypted before rotation can still be decrypted using the previous key as long as it is available. Option B is correct because cloud KMS retains previous key versions after rotation, allowing decryption of data encrypted with older keys. The key rotation creates a new cryptographic key version, but the old version remains active for decryption until it is disabled or deleted. This ensures that data encrypted before rotation remains accessible without re-encryption.

Answer

Key rotation is not supported in cloud KMS

Answer

The KMS automatically re-encrypts all data with the new key

Answer

Existing data encrypted with the previous key must be re-encrypted with the new key

Question 10

A cloud security engineer is reviewing incident response procedures for a hybrid cloud environment. During a security incident, the team needs to collect forensic evidence from a compromised virtual machine while preserving its state. Which of the following actions should be taken first?

Accepted Answer

Disconnect the virtual machine from the network. Option A is correct because isolating the VM (disconnecting it from the network) prevents further damage or data exfiltration, and then a snapshot can be taken. Option B (snapshot) comes after isolation. Option C (install agent) may alter the evidence. Option D (notify provider) is done in parallel but not first.

Answer

Take a snapshot of the virtual machine's disk

Answer

Notify the cloud provider

Answer

Install a forensic agent on the virtual machine

Question 11

A security analyst is investigating a data breach in a cloud environment. The analyst needs to preserve evidence for legal proceedings. Which of the following actions is most critical to ensure the chain of custody is maintained?

Accepted Answer

Begin a detailed log documenting all actions, timestamps, and personnel involved.. Chain of custody requires documenting every transfer of evidence. Option B is correct because starting a log of all actions with timestamps and personnel ensures accountability. Option A is wrong because notifying management is important but not the most critical for chain of custody. Option C is wrong because isolating systems can destroy volatile data. Option D is wrong because while important, unique hashing alone does not document custody.

Answer

Calculate cryptographic hashes of all relevant files.

Answer

Isolate all affected systems from the network to prevent further data loss.

Answer

Immediately notify senior management and legal counsel.

Question 12

During a security incident in a multi-tenant cloud environment, the cloud provider's logging system indicates that a virtual machine (VM) on a shared hypervisor has been compromised. The provider wants to assist the customer with forensic analysis while minimizing impact to other tenants. Which approach is most appropriate?

Accepted Answer

Provide the customer with a memory snapshot of the compromised VM.. Option B is correct because providing a memory snapshot of the compromised VM preserves volatile forensic data (e.g., running processes, network connections, encryption keys) without disrupting the hypervisor or other tenants. This approach adheres to the cloud provider's responsibility to isolate forensic evidence while maintaining multi-tenant isolation, as memory snapshots can be taken via hypervisor-level APIs (e.g., VMware VMotion or libvirt) without powering off the VM or cloning the entire host.

Answer

Rebuild the VM from a known good image and then run security scans.

Answer

Clone the entire hypervisor and give the customer access to the clone.

Answer

Power off the VM immediately to contain the incident.

Question 13

A company uses an Infrastructure as a Service (IaaS) provider for critical applications. They need to define a backup retention policy that meets regulatory requirements for keeping financial records for 7 years. Which of the following strategies best meets this requirement while optimizing costs?

Accepted Answer

Perform daily backups, keep weekly backups for 3 months, monthly for 1 year, and yearly for 7 years in cold storage.. Option B is correct because it implements a tiered backup retention strategy that aligns with the 7-year regulatory requirement while minimizing storage costs. By transitioning weekly backups to cold storage after 3 months, monthly backups after 1 year, and yearly backups for the full 7 years, the company reduces the cost of storing infrequently accessed data. This approach leverages the IaaS provider's lifecycle management policies (e.g., AWS S3 Lifecycle or Azure Blob Storage access tiers) to automatically move backups to lower-cost storage classes like Glacier or Archive, which are optimized for long-term retention.

Answer

Perform daily full backups and retain all backups for 7 years.

Answer

Replicate all backups to a secondary region with snapshots kept for 7 years.

Answer

Use a grandfather-father-son rotation scheme with weekly, monthly, and yearly backups.

Question 14

An organization has implemented a change management process for its cloud infrastructure. During a routine change, a network security group rule is modified incorrectly, causing a critical application to become inaccessible. What is the most effective way to prevent this issue in future changes?

Accepted Answer

Integrate automated configuration validation tests into the change pipeline.. Option D is correct because automated testing validations catch misconfigurations before production deployment. Option A is wrong because requiring manager approval does not prevent technical errors. Option B is wrong because peer review helps but is manual and can miss issues. Option C is wrong because rollback plans are reactive, not preventive.

Answer

Require all changes to be approved by two managers.

Answer

Ensure every change has a rollback plan.

Answer

Implement a peer review process for all change requests.

Question 15

A cloud security team needs to implement a logging strategy that captures user activity, API calls, and resource changes across multiple cloud services. The logs must be tamper-proof and retained for at least one year. Which combination of actions best meets these requirements?

Accepted Answer

Centralize logs into a dedicated log archive account with write-once-read-many (WORM) storage and enable anomaly detection alerts.. Option C is correct because centralizing logs with write-once storage ensures tamper-proof retention, and alerting on anomalies provides security monitoring. Option A is wrong because encryption alone does not prevent tampering, and simple log management may allow deletion. Option B is wrong because using separate log accounts for each service creates silos and complexity. Option D is wrong because exporting to SIEM is good but retention should be in immutable storage.

Answer

Stream all logs to a Security Information and Event Management (SIEM) system and retain raw logs for one year on standard storage.

Answer

Enable logging for all services, encrypt logs at rest, and store them in a centralized log management system.

Answer

Use separate logging accounts for each cloud service and retain logs in their native format.