hardMultiple Choice
CS0-003 Practice Question: A cloud tenant shows an unusual spike in IAM…
A cloud tenant shows an unusual spike in IAM policy changes, access key creation, and failed console logons from a new country. Which telemetry set gives the strongest evidence for control-plane compromise? In the alert triage phase, Which action gives the analyst the clearest next triage step?
⚠ Common exam trap
It's easy for candidates to confuse data-plane telemetry (endpoint AV, packet captures) with control-plane telemetry, failing to recognize that only cloud audit logs can capture administrative API calls like IAM policy changes and key creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud audit logs for identity, policy, and key-management API calls
Cloud audit logs (e.g., AWS CloudTrail, Azure Activity Log) capture control-plane API calls such as IAM policy changes, key creation, and authentication failures. These logs directly record the identity and resource management actions that indicate a compromise of the cloud management plane, whereas endpoint or network telemetry only reflects data-plane activity and cannot see API-level administrative actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Endpoint antivirus quarantine reports only
Why it's wrong here
Endpoint antivirus quarantine reports cover local malware detections, not cloud IAM policy changes, access key creation, or failed console logons from a new country. They are tempting because antivirus is a familiar triage source, and would be correct when the alert concerns endpoint malware execution rather than control-plane compromise.
- ✗
Packet captures from user laptops only
Why it's wrong here
Packet captures from user laptops show endpoint network traffic, not the cloud control plane's IAM and console events, so they miss the policy changes and key creation entirely. They are tempting because packet capture gives rich detail, and would be the right choice when investigating endpoint malware command-and-control or data exfiltration.
- ✓
Cloud audit logs for identity, policy, and key-management API calls
Why this is correct
Cloud audit logs capture control-plane API calls such as IAM policy changes, access key creation and console sign-in attempts, tying each action to an identity and source IP. This directly evidences control-plane compromise, unlike data-plane or endpoint telemetry.
- ✗
Web server access logs from the public website
Why it's wrong here
Web server access logs record HTTP requests to the public site, not IAM policy changes, access key creation, or console logon attempts, so they cannot evidence control-plane activity. They are tempting because they are readily available and useful for investigating web application attacks, which is the correct scenario for this telemetry.
Go deeper
Related to this question
Learn chapter
Endpoint Detection and Response
Key term
Telemetry
Telemetry is the automatic collection, transmission, and measurement of data from remote sources to a central system for analysis and monitoring.
Key term
Access key
An access key is a unique identifier and secret code pair used to authenticate requests to cloud storage services, ensuring only authorized users or applications can access data.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.