CCSP Cloud Security Operations Practice Question
A cloud security analyst is investigating a potential credential compromise in AWS. Which TWO CloudTrail events would be most relevant to establishing a timeline of the compromise?
⚠ Common exam trap
ISC2 often tests the distinction between events that indicate the initial compromise (like credential creation) versus events that are merely post-compromise reconnaissance or data destruction, leading candidates to select DescribeInstances or DeleteBucket as they seem suspicious but are not timeline-establishing events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CreateAccessKey
(CreateAccessKey) is correct because the creation of a new access key pair is a strong indicator of an attacker establishing persistent programmatic access to an AWS account. This event, logged by CloudTrail as 'CreateAccessKey' in the IAM service, provides a precise timestamp for when the attacker may have generated credentials to maintain access outside of the console.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DeleteBucket
Why it's wrong here
This could be part of an attack but not directly for credential timeline.
- ✗
UpdateLoginProfile
Why it's wrong here
This changes password policy but is less common in compromise timelines.
- ✓
CreateAccessKey
Why this is correct
An attacker may create new access keys to maintain persistence.
- ✗
DescribeInstances
Why it's wrong here
This is a read operation and not directly indicative of compromise.
- ✓
ConsoleLogin
Why this is correct
Records when and from where a user logs into the console.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.