mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: A company's security team is investigating an…
A company's security team is investigating an anomalous spike in outbound traffic from a cloud workload. The workload is a web server running in an IaaS environment. The team suspects data exfiltration. Which of the following is the BEST initial step to identify the source and type of traffic?
⚠ Common exam trap
ISC2 often tests the distinction between investigative actions and reactive containment; the trap here is that candidates may choose immediate isolation (Option A) as a 'best first step' when the question explicitly asks for the step to 'identify the source and type of traffic,' not to stop it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable VPC flow logs for the subnet hosting the workload and analyze the logs.
VPC flow logs capture metadata about all IP traffic to and from network interfaces in a subnet, including source/destination IPs, ports, protocols, and packet/byte counts. Analyzing these logs allows the security team to identify the external destination IPs and ports involved in the anomalous outbound traffic, which is the fastest way to pinpoint the source workload and characterize the exfiltration pattern without disrupting service or requiring agent deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately isolate the workload by blocking all outbound traffic in the security group.
Why it's wrong here
Isolation may be necessary later, but it would stop the potential exfiltration and prevent further analysis of the traffic.
- ✗
Deploy a host-based intrusion detection system (HIDS) agent on the workload.
Why it's wrong here
HIDS agents are useful but may not be installed yet and require time to deploy; flow logs can be enabled immediately.
- ✗
Run a vulnerability scanner against the workload to identify possible entry points.
Why it's wrong here
Vulnerability scanning does not reveal current network traffic patterns or ongoing data exfiltration.
- ✓
Enable VPC flow logs for the subnet hosting the workload and analyze the logs.
Why this is correct
VPC flow logs provide network-level visibility and can quickly show anomalous outbound connections without requiring agent installation.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.