hardMultiple SelectObjective-mapped
CCSP Practice Question: A cloud security engineer is investigating a…
A cloud security engineer is investigating a potential data breach in a cloud environment. The organization uses a cloud access security broker (CASB) and has deployed a security information and event management (SIEM) system. Which of the following are likely indicators that the CASB has detected unauthorized data exfiltration? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Anomalous spike in outbound traffic to an unknown IP address
Options A and C are correct. A CASB detects anomalous data movements. An anomalous spike in outbound traffic to an unknown IP address (A) and a large number of file downloads by a single user outside business hours (C) are strong indicators of data exfiltration. Option B, a change in firewall rule configuration, is a configuration change that does not directly indicate exfiltration. Option D, multiple failed login attempts, typically indicates a brute-force attack rather than exfiltration. Option E, an alert for a known malware signature, indicates a malware threat but not necessarily data exfiltration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Anomalous spike in outbound traffic to an unknown IP address
Why this is correct
Unusual outbound traffic patterns can indicate data exfiltration.
- ✗
A change in the configuration of a firewall rule
Why it's wrong here
Configuration changes may be part of an attack but are not a direct indicator of exfiltration.
- ✓
A large number of file downloads by a single user outside of business hours
Why this is correct
Unusual download volume can be a sign of data theft.
- ✗
Multiple failed login attempts to a critical application
Why it's wrong here
This is more likely an authentication attack, not exfiltration.
- ✗
An alert for a known malware signature in an email attachment
Why it's wrong here
Malware detection is more relevant to email security, not cloud data loss.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.