CS0-003 Security Operations Practice Question
A security team is reviewing cloud audit logs from AWS CloudTrail and notices repeated API calls to create EC2 instances in a region where the organization has no presence. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compromised AWS credentials
Unauthorized API calls to create resources in unusual regions often indicate compromised credentials or an attacker using the account for cryptomining.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Compromised AWS credentials
Why this is correct
When threat actors acquire leaked or stolen AWS Access Keys, they frequently leverage programmatic access to bypass MFA and spin up high-compute EC2 instances for cryptomining. This malicious activity is typically detected via AWS CloudTrail logs showing API calls originating from unfamiliar IP addresses or targeting unused geographic regions.
- ✗
Configuration drift
Why it's wrong here
Configuration drift refers to the gradual deviation of a cloud environment's state from its defined infrastructure-as-code (IaC) templates due to manual ad-hoc changes. While drift poses compliance and security risks, it does not explain unauthorized API calls or the sudden provisioning of new resources by external, unknown actors.
- ✗
Service outage
Why it's wrong here
Repeated EC2 creation in an unused region indicates compromised credentials being abused, not a service outage, which would cause API failures rather than successful instance launches. Outage monitoring is the right tool when investigating availability incidents affecting existing resources, but CloudTrail here records authorised calls succeeding.
- ✗
Valid administrative activity
Why it's wrong here
Legitimate administrative tasks follow established change management procedures and originate from known corporate IP ranges or VPNs. API calls executing resource creation in historically unused AWS regions, especially outside of business hours, strongly indicate credential abuse rather than authorized operations.
Go deeper
Related to this question
Learn chapter
Cloud Security Posture Management (CSPM)
Key term
CloudTrail
AWS CloudTrail is a service that records every action taken in your AWS account, creating a detailed log of who did what and when for security and auditing purposes.
Key term
AWS CloudTrail
AWS CloudTrail is a service that records every action taken in your AWS account, like a security camera that logs who did what and when.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.