hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A cloud tenant shows an unusual spike in IAM…
A cloud tenant shows an unusual spike in IAM policy changes, access key creation, and failed console logons from a new country. Which telemetry set gives the strongest evidence for control-plane compromise? In the alert triage phase, Which action gives the analyst the clearest next triage step?
⚠ Common exam trap
It's easy for candidates to confuse data-plane telemetry (endpoint AV, packet captures) with control-plane telemetry, failing to recognize that only cloud audit logs can capture administrative API calls like IAM policy changes and key creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud audit logs for identity, policy, and key-management API calls
Cloud audit logs (e.g., AWS CloudTrail, Azure Activity Log) capture control-plane API calls such as IAM policy changes, key creation, and authentication failures. These logs directly record the identity and resource management actions that indicate a compromise of the cloud management plane, whereas endpoint or network telemetry only reflects data-plane activity and cannot see API-level administrative actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Endpoint antivirus quarantine reports only
Why it's wrong here
Endpoint reports may be useful later but do not directly explain cloud control-plane changes.
- ✗
Packet captures from user laptops only
Why it's wrong here
Network captures may not show cloud API intent or identity changes.
- ✓
Cloud audit logs for identity, policy, and key-management API calls
Why this is correct
Control-plane attacks are best investigated through authoritative audit events that record who changed identity and access configuration.
- ✗
Web server access logs from the public website
Why it's wrong here
Web logs do not prove IAM policy or key-management activity.
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Telemetry
Telemetry is the automatic collection, transmission, and measurement of data from remote sources to a central system for analysis and monitoring.
Key term
Access key
An access key is a unique identifier and secret code pair used to authenticate requests to cloud storage services, ensuring only authorized users or applications can access data.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.