hardMultiple ChoiceObjective-mapped
CCSP Practice Question: Migrating a critical application to the cloud and…
A company is migrating a critical application to the cloud and must ensure that its security operations center (SOC) can detect and respond to threats in real time. The application generates high volumes of logs. Which combination of services would provide the MOST efficient and cost-effective solution for centralized logging, analysis, and alerting?
⚠ Common exam trap
ISC2 often tests the misconception that simple storage or manual review is sufficient for real-time threat detection, but the CCSP emphasizes that centralized logging without analysis and correlation fails to meet SOC operational requirements for real-time response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a Security Information and Event Management (SIEM) system with real-time correlation and a log management solution that auto-scales.
A SIEM system with real-time correlation enables the SOC to detect threats as they occur by analyzing log data across multiple sources, while an auto-scaling log management solution ensures cost efficiency by dynamically adjusting resources to handle high log volumes without over-provisioning. This combination provides centralized logging, real-time analysis, and alerting, meeting the requirement for efficient and cost-effective threat detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a basic monitoring tool that triggers alerts based on static thresholds.
Why it's wrong here
Static thresholds are not effective for complex threat detection.
- ✓
Implement a Security Information and Event Management (SIEM) system with real-time correlation and a log management solution that auto-scales.
Why this is correct
SIEM provides real-time correlation and auto-scaling handles high volumes efficiently.
- ✗
Use a cloud-native log storage service with long retention and no analysis.
Why it's wrong here
Without analysis, threats cannot be detected.
- ✗
Store logs in a centralized log server and have SOC analysts manually review them.
Why it's wrong here
Manual review cannot keep up with high log volumes and is not real-time.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.