CCSP Workflow orchestration Practice Question
A security engineer is implementing automated incident response for common cloud threats. Which TWO cloud services can be used together to create a serverless orchestration workflow for incident response? (Choose two.)
⚠ Common exam trap
The trap is confusing orchestration with infrastructure as code or monitoring services; candidates might pick CloudFormation or Inspector, but the key is serverless workflow orchestration and compute.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Orchestration service for serverless workflows
Option A, an orchestration service for serverless workflows (such as AWS Step Functions), is correct because it provides the state-machine logic that coordinates, sequences, and branches incident-response steps without managing servers. Option B, a serverless compute service (such as AWS Lambda), is correct because it executes the actual response actions—enriching findings, isolating resources, or notifying teams—as event-driven functions invoked by the orchestration workflow. Together, A and B form a fully serverless orchestration pipeline: the workflow service defines the incident-response state machine while the compute service runs the per-step code. Option C, infrastructure as code, is for declaratively provisioning resources, not for orchestrating runtime incident-response logic. Option D, a virtual machine service, requires managing persistent instances and is not serverless. Option E, vulnerability management, identifies weaknesses but does not orchestrate or execute response workflows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Orchestration service for serverless workflows
Why this is correct
A serverless orchestration service, such as AWS Step Functions, sequences incident response steps, branching and retrying between Lambda invocations. It satisfies the serverless orchestration workflow requirement by coordinating state across tasks without provisioning servers, complementing the serverless compute service chosen alongside it.
- ✓
Serverless compute service
Why this is correct
Serverless compute, such as AWS Lambda, executes the individual response actions — isolating instances, revoking credentials, tagging resources — that the orchestration service sequences. It satisfies the serverless requirement because functions run on demand without server management, providing the execution layer the workflow invokes.
- ✗
Infrastructure as code service
Why it's wrong here
Infrastructure as code provisions and configures resources declaratively; it does not run event-driven response logic at incident time. It is tempting because it automates cloud deployment, but serverless orchestration requires a function service and a workflow or queue service instead.
- ✗
Virtual machine service
Why it's wrong here
Virtual machines run continuously and require provisioning, so they cannot form a serverless, event-driven orchestration workflow. It is tempting when existing tooling or agents must run on persistent hosts, but serverless functions and a workflow/queue service are needed here.
- ✗
Vulnerability management service
Why it's wrong here
A vulnerability management service scans and reports findings; it does not execute orchestration steps or invoke remediation actions. It is tempting because it feeds incident data into response pipelines, but the workflow itself needs serverless compute plus a coordination service.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.