CCSP Cloud Security Operations Practice Question
A security team is investigating a potential credential compromise in a cloud environment. They have cloud audit logs showing a user's access key was used to provision compute instances in a geographic region where the user has never operated. What is the BEST course of action to confirm and contain the incident?
⚠ Common exam trap
ISC2 CCSP often tests the distinction between 'containment' (stopping the attack) and 'remediation' (cleaning up resources); the trap here is that candidates may choose to delete resources (Option C) or disable the user entirely (Option D) instead of focusing on the compromised credential itself, which is the root cause of the incident.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check cloud audit logs for the access key events, then rotate the access key.
The first step in confirming a potential credential compromise is to verify that the anomalous activity (instance launches in an unfamiliar region) is indeed associated with the specific access key in the audit logs. Once confirmed, rotating the key (i.e., deactivating the old key and issuing a new one) immediately invalidates the compromised credential, stopping any further unauthorized use while preserving the user's ability to operate with a new key. This aligns with cloud security incident response best practices for credential compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new access policy to deny all actions for that user.
Why it's wrong here
This might not revoke existing sessions and is slower than rotating the key.
- ✓
Check cloud audit logs for the access key events, then rotate the access key.
Why this is correct
This confirms the usage and revokes the compromised key.
- ✗
Immediately delete all compute instances launched by that user.
Why it's wrong here
May destroy evidence; containment should focus on credentials first.
- ✗
Disable the user's console access and delete the access key.
Why it's wrong here
Deletion may be permanent; rotation is better for investigation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.