CCSP Cloud Security Operations Practice Question
An organization is using GCP and wants to implement automated remediation of security misconfigurations. Which TWO services can be used together to achieve this? (Choose two.)
⚠ Common exam trap
The ISC2 CCSP exam often tests the distinction between services that detect or log issues (like Cloud Audit Logs or Cloud SCC alone) versus services that can execute automated remediation (like Cloud Functions), leading candidates to mistakenly select Cloud Audit Logs or Cloud Storage as capable of performing actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Functions
Cloud Functions (D) is correct because it can be triggered by events from Cloud Security Command Center (Cloud SCC) to automatically remediate security misconfigurations. Cloud SCC detects vulnerabilities and misconfigurations, and Cloud Functions can execute remediation logic such as modifying IAM policies, enabling logging, or updating firewall rules. Together, they enable event-driven, automated security response without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Build
Why it's wrong here
Cloud Build is for CI/CD, not remediation.
- ✗
Cloud Audit Logs
Why it's wrong here
Audit logs record activity but do not trigger remediation.
- ✗
Cloud Storage
Why it's wrong here
Storage is not for automation.
- ✓
Cloud Functions
Why this is correct
Cloud Functions can execute remediation code when triggered by Security Command Center.
- ✓
Cloud Security Command Center
Why this is correct
Security Command Center provides findings that can trigger automated actions.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.