CCSP Cloud Security Operations Practice Question
An organization is using GCP Security Command Center with Event Threat Detection. Which type of event is most likely to generate a finding for 'exfiltration'?
⚠ Common exam trap
A common trap in the ISC2 CCSP exam is confusing an anomalous sign-in event (Option B) with data exfiltration. Exfiltration requires a data transfer action, such as downloading many objects from a storage bucket, not just authentication from a new location.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A large number of objects being downloaded from a Cloud Storage bucket
Event Threat Detection (ETD) in GCP Security Command Center monitors Cloud Storage access logs for anomalous data access patterns. A large number of object downloads from a single bucket within a short time window is a strong indicator of data exfiltration, as it matches the behavioral signature of bulk data extraction. ETD uses machine learning models trained on normal access baselines to flag such volume-based anomalies as 'exfiltration' findings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service account creating a new VM
Why it's wrong here
This is resource creation, not exfiltration.
- ✗
A user logging in from a new IP address
Why it's wrong here
This is an authentication anomaly, not exfiltration.
- ✗
A firewall rule change allowing all inbound traffic
Why it's wrong here
This is a configuration change, not exfiltration.
- ✓
A large number of objects being downloaded from a Cloud Storage bucket
Why this is correct
High volume of downloads is a common exfiltration indicator.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.