CCSP Cloud Security Operations Practice Test 6 — 15 Questions

Question 1

An incident response team is investigating a potential breach in a cloud environment. They have collected logs from various sources. Which of the following is the MOST critical factor to ensure the admissibility of digital evidence in court?

Accepted Answer

Maintaining a documented chain of custody for all evidence. Option A is correct because maintaining the chain of custody ensures evidence integrity and admissibility. Option B is wrong while important for investigation, admissibility depends on custody. Option C is wrong because logs may not be original but certified copies can be used if chain of custody is maintained. Option D is wrong because encryption does not guarantee authenticity.

Answer

Encrypting all evidence during collection and transport

Answer

Using automated tools for log analysis

Answer

Ensuring logs are in their original format

Question 2

Which TWO of the following are best practices for implementing baseline configuration management in a cloud environment? (Choose two.)

Accepted Answer

Automate the deployment of baseline configurations using orchestration tools. Automating the deployment of baseline configurations using orchestration tools (e.g., AWS CloudFormation, Terraform, or Ansible) ensures consistency, reduces human error, and enforces security controls across cloud resources. This aligns with the principle of immutable infrastructure, where configurations are deployed programmatically rather than manually adjusted.

Answer

Allow administrators to manually adjust configurations as needed to maintain flexibility

Answer

Disable configuration drift detection to reduce alert fatigue

Answer

Grant all users read/write access to configuration repositories for efficiency

Question 3

Which THREE of the following are key components of an incident response plan specific to cloud environments? (Choose three.)

Accepted Answer

Establishing a process for preserving system snapshots and logs as evidence. Options B, D, and E are correct. B: Contacting the cloud provider is essential for assistance and evidence preservation. D: Understanding the shared responsibility model clarifies who does what. E: Documenting system baseline configurations helps identify changes. Option A is wrong because data forensic analysis is part of response but not a plan component; more specifically, the plan should include procedures, not just analysis. Option C is wrong because primarily the incident response team handles, but legal involvement is case-specific, not necessarily all incidents.

Answer

Requiring involvement of the legal department for every incident

Answer

Including a detailed data forensic analysis procedure for all incident types

Question 4

Which TWO of the following are valid considerations when performing forensic imaging of virtual machines in a public cloud? (Choose two.)

Accepted Answer

Time synchronization between the imaging tool and the VM clock is essential. Options A and D are correct. A: In-memory data is lost when VM is stopped, so acquire while running. D: Time synchronization is important for timeline analysis. Option B is wrong because cloud provider typically does not allow direct access to hypervisor memory for forensic purposes. Option C is wrong because hypervisor-level isolation prevents accessing other tenants' images.

Answer

The imaging process must be performed from within the same cloud region

Answer

Images of other tenants' VMs can be accessed through the hypervisor if needed

Answer

The cloud provider will provide hypervisor memory dumps upon request

Question 5

Refer to the exhibit. An AWS CloudTrail log entry is shown. Which of the following can be determined from this log entry?

Accepted Answer

The instance launch was performed by user john.doe via the console. Option C is correct because the log shows the event was initiated by the IAM user john.doe from IP 203.0.113.50 via the AWS Management Console. Option A is wrong because there is no indication of an S3 access. Option B is wrong because the region is us-east-1, not eu-west-2. Option D is wrong because the event is RunInstances, not TerminateInstances.

Answer

The instance was terminated immediately after launch

Answer

The instance was launched in eu-west-2

Answer

An S3 bucket policy was modified

Question 6

A company runs its production workloads on a cloud infrastructure-as-a-service (IaaS) platform. The security operations team uses a SIEM to monitor security events. Over the past week, they have observed an increasing number of alerts indicating failed login attempts to a critical database server. The source IP addresses are varied and originate from different geographic regions. The team has also noticed that the database server's CPU usage has spiked during non-business hours. The database is not exposed to the internet; it is in a private subnet. The security team suspects that the database credentials have been compromised. Which of the following actions should the security team take FIRST to mitigate the risk?

Accepted Answer

Rotate the database credentials immediately. Option C is correct. The first step should be to rotate the database credentials to prevent further unauthorized access. The failed login attempts indicate active exploitation, and credential rotation is the immediate mitigation. Option A is wrong because blocking IPs is ineffective since they are varied and dynamic. Option B is wrong because while investigating the source is important, it does not stop the ongoing attacks. Option D is wrong because while enabling MFA is good, the immediate priority is to stop access via compromised credentials.

Answer

Conduct a forensic investigation to determine how the credentials were compromised

Answer

Block the source IP ranges identified in the SIEM alerts at the network firewall

Answer

Enable multi-factor authentication on the database server

Question 7

A cloud customer is migrating a legacy application to a cloud platform. The application currently runs on physical servers and uses local storage. The migration plan involves rehosting the application on virtual machines (VMs) in the cloud. The security team wants to ensure that the VMs are properly hardened before deployment. During the migration testing, the team discovers that the base image used for the VMs contains several unnecessary services and default credentials. The team is concerned that these vulnerabilities could be exploited. The cloud provider offers a shared responsibility model where the customer is responsible for securing the OS. Which of the following is the BEST course of action to address this issue?

Accepted Answer

Create a custom golden image with necessary hardening and approved software only. Option C is correct because creating a custom golden image allows the customer to enforce a hardened baseline that removes unnecessary services, disables default credentials, and includes only approved software before any VM is deployed. This aligns with the shared responsibility model, where the customer controls OS-level security, and prevents vulnerabilities from ever reaching production. Pre-hardening the image is more secure and efficient than fixing issues post-deployment, as it eliminates the window of exposure during initial boot and configuration.

Answer

Deploy the VMs and run vulnerability scans to identify and fix issues after deployment

Answer

Ask the cloud provider to provide a hardened OS image

Answer

Deploy the VMs and manually apply security patches and remove services after deployment

Question 8

A financial services company is migrating a critical application to the cloud. They must ensure that the cloud provider supports the ability to conduct forensic investigations in case of a security incident. Which of the following is the MOST important requirement to include in the contract?

Accepted Answer

The provider must grant the customer access to raw logs and the ability to perform memory captures on virtual instances.. Option B is correct because access to raw logs is essential for forensic investigations. Option A is wrong because automatic patching is a security measure but not specific to forensics. Option C is wrong because geographic restrictions are about data residency, not forensics. Option D is wrong because uptime guarantees are about availability, not forensic capability.

Answer

The provider must guarantee 99.999% uptime for all cloud services used.

Answer

The provider must automatically patch all virtual machines within 24 hours of patch release.

Answer

The provider must store data only in data centers located within the country of operation.

Question 9

A cloud security architect is designing a defense-in-depth strategy for a multi-tenant IaaS environment. Which of the following controls would BEST protect against workload isolation failure due to a hypervisor vulnerability?

Accepted Answer

Deploy a dedicated virtual firewall instance for each tenant to enforce network segmentation.. Option D is correct because a dedicated firewall instance for each tenant provides network-level isolation independent of the hypervisor. Option A is wrong because hypervisor hardening is necessary but does not guarantee isolation if a vulnerability exists. Option B is wrong because vulnerability scanning is detective, not preventive. Option C is wrong while encryption protects data at rest, it does not prevent a hypervisor escape.

Answer

Perform weekly vulnerability scans of the hypervisor and tenant workloads.

Answer

Apply the latest hypervisor security patches and disable unnecessary services.

Answer

Use encrypted virtual disks for all tenant virtual machines.

Question 10

A multinational corporation uses a hybrid cloud model with on-premises data centers and the AWS cloud. They have implemented a Cloud Access Security Broker (CASB) to enforce security policies. Recently, the security team noticed that users are accessing cloud applications from unusual geographic locations and downloading large volumes of data. The CASB logs show that the users authenticated using single sign-on (SSO) with valid credentials. The company has not enabled multi-factor authentication (MFA) for all users due to a previous pushback from the user community. The security team suspects a credential theft incident. What is the BEST course of action to mitigate the risk and respond to the potential incident?

Accepted Answer

Revoke the suspicious sessions and require all users to re-authenticate with MFA before granting access to cloud applications.. Option C is correct because immediately revoking the suspicious sessions and requiring MFA re-authentication stops the potential attack and enforces stronger security. Option A is wrong because disabling SSO would disrupt business operations and not address the root cause. Option B is wrong while resetting passwords helps, without MFA the new passwords could also be stolen. Option D is wrong because locking all accounts is too disruptive and assumes all users are compromised, which is not indicated.

Answer

Ask the affected users to change their passwords and monitor their accounts for further suspicious activity.

Answer

Lock all user accounts and require the IT team to manually verify each user's identity before unlocking.

Answer

Disable SSO immediately and require users to authenticate directly with the cloud applications.

Question 11

A cloud security engineer is responsible for a SaaS application hosted on a public cloud provider. The application uses a relational database to store customer data. The security team recently conducted a vulnerability assessment and discovered that the database can be accessed over the internet without any network restrictions. Additionally, the database admin user has the same password as the root account, and the password has not been changed in 18 months. The company is subject to GDPR and PCI DSS compliance requirements. The engineer needs to remediate these issues immediately. Which of the following actions should be taken FIRST?

Accepted Answer

Configure the database security group to allow traffic only from the application server's IP address range.. Option B is correct because restricting network access to authorized sources only is the most immediate way to reduce the attack surface and prevent unauthorized access over the internet. Option A is wrong because changing the password is important but should follow the network restriction to ensure the database is not exposed during the change. Option C is wrong while enabling encryption is a best practice, it does not prevent an attacker from connecting directly. Option D is wrong because upgrading the database might not be immediately available and does not address the access issue.

Answer

Change the database admin password to a complex new password immediately.

Answer

Upgrade the database to the latest version with all security patches applied.

Answer

Enable encryption at rest for the database to protect the data if it is stolen.

Question 12

A cloud operations team manages a critical application on AWS that uses EC2 instances behind an Application Load Balancer (ALB). The application experiences occasional high latency and timeout errors. The team has enabled detailed monitoring and CloudWatch Logs. They notice that during peak hours, the CPU utilization on some instances reaches 95%, while others remain around 40%. The security group allows traffic from a wide range of IP addresses. The team needs to improve both performance and security. Which of the following actions would BEST address the performance imbalance and also enhance security posture?

Accepted Answer

Create an auto scaling group with a dynamic scaling policy based on average CPU utilization, change the ALB to a Network Load Balancer for lower latency, and restrict the security group rules to the minimal required IP addresses.. Option D is correct because implementing an auto scaling policy based on CPU and swapping the ALB to a Network Load Balancer (NLB) for better performance, combined with tightening security group rules, addresses both issues. Option A is wrong because increasing instance size is not a dynamic solution and does not help with the imbalance. Option B is wrong because scheduling scaling based on time may not align with unpredictable traffic. Option C is wrong because a Classic Load Balancer is older and less capable; also, round-robin without considering load may not fix the imbalance.

Answer

Schedule a periodic cron job to launch additional instances during expected peak hours and configure the ALB to use sticky sessions.

Answer

Increase the instance size to a larger type that can handle peak loads and reduce the security group to allow only known IP ranges.

Answer

Replace the ALB with a Classic Load Balancer and configure it to use round-robin routing without health checks to balance traffic quickly.

Question 13

A company is migrating its on-premises virtualized environment to the Azure cloud. The security team wants to ensure they can detect and respond to security incidents in the cloud. They plan to use Azure Security Center and Azure Sentinel. The on-premises environment uses a SIEM tool and logs from all servers are forwarded to it. In the cloud, they have provisioned virtual machines (VMs) running various workloads. The team needs to ensure that all security events from these VMs are captured and analyzed. Which of the following steps should they take FIRST to achieve comprehensive log collection?

Accepted Answer

Enable Azure Diagnostics extension and install the Log Analytics agent on all VMs to send logs to a Log Analytics workspace.. Option A is correct because enabling Azure Diagnostics and the Log Analytics agent on all VMs sends logs to Azure Monitor and Log Analytics workspace, which is the foundation for Sentinel and Security Center. Option B is wrong because enabling network security group flow logs is important for network data, but not for VM-level logs. Option C is wrong while the Security Center collects security events, it may not cover all custom logs; the agent is needed for full coverage. Option D is wrong because configuring VDI for administrators does not address general VM logging.

Answer

Set up a jump box VM with administrative tools and restrict access to it using just-in-time VM access.

Answer

Enable Azure Security Center's standard tier and rely on its built-in security events collection.

Answer

Configure network security group flow logs and send them to a storage account for analysis.

Question 14

A healthcare organization is using a cloud-based electronic health record (EHR) system hosted on a PaaS platform. The platform provides a web interface and an API for integration with internal systems. The organization's security policy requires encryption of all data at rest and in transit. They have implemented SSL/TLS for data in transit and enabled server-side encryption for the database. However, during a recent audit, it was discovered that the API returns diagnostic data in clear text when accessed from internal networks. The internal network is considered trusted. The auditor recommends implementing end-to-end encryption. Which of the following is the BEST approach to meet this requirement?

Accepted Answer

Configure the API to require mutual TLS (mTLS) authentication and use TLS 1.2 or higher for all connections from internal systems.. Option C is correct because implementing mutual TLS (mTLS) ensures that only authenticated clients (internal systems) can communicate with the API and all data is encrypted end-to-end. Option A is wrong because client-side encryption requires key management and does not guarantee encryption in transit between the internal systems and the API. Option B is wrong because using a VPN adds latency and complexity; mTLS is more lightweight and still encrypts the data. Option D is wrong because sending data through a separate encryption endpoint adds extra components and potential points of failure.

Answer

Implement client-side encryption on the internal systems before sending data to the API.

Answer

Set up a VPN connection between the internal network and the cloud PaaS environment to encrypt all traffic.

Answer

Create a proxy service in the cloud that encrypts the data before forwarding it to the API.

Question 15

A cloud security team is developing an incident response plan for a SaaS application hosted on a public cloud. During the preparation phase, which TWO steps are most critical to include?

Accepted Answer

Conduct regular tabletop exercises to simulate incident scenarios. Conducting regular tabletop exercises (Option A) is critical during the preparation phase because it validates the incident response plan's effectiveness, identifies gaps in team coordination, and ensures stakeholders understand their roles without impacting production systems. This proactive simulation aligns with NIST SP 800-61 and CCSP best practices for readiness testing before an actual incident occurs.

Answer

Conduct a post-mortem analysis of previous incidents

Answer

Implement automated isolation of compromised instances

Answer

Deploy a security information and event management (SIEM) system