CCSP Cloud Security Operations Practice Question
An organization is using GCP Security Command Center with Event Threat Detection. Which type of event is most likely to generate a finding for 'exfiltration'?
⚠ Common exam trap
A common trap in the ISC2 CCSP exam is confusing an anomalous sign-in event (Option B) with data exfiltration. Exfiltration requires a data transfer action, such as downloading many objects from a storage bucket, not just authentication from a new location.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A large number of objects being downloaded from a Cloud Storage bucket
Event Threat Detection (ETD) in GCP Security Command Center monitors Cloud Storage access logs for anomalous data access patterns. A large number of object downloads from a single bucket within a short time window is a strong indicator of data exfiltration, as it matches the behavioral signature of bulk data extraction. ETD uses machine learning models trained on normal access baselines to flag such volume-based anomalies as 'exfiltration' findings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service account creating a new VM
Why it's wrong here
Creating a new VM is a resource-provisioning action, generating findings about persistence, cryptomining or resource abuse rather than data leaving the environment. It is tempting because attackers do create instances, but it would be correct for a defence-evasion or resource-abuse finding, not exfiltration.
- ✗
A user logging in from a new IP address
Why it's wrong here
A login from a new IP address is an authentication anomaly, mapping to suspicious login or credential-compromise findings, with no data movement involved. It is tempting because unusual logins often precede breaches, but it would be correct for Event Threat Detection's anomalous-login or account-compromise detections.
- ✗
A firewall rule change allowing all inbound traffic
Why it's wrong here
An inbound-permitting firewall rule change is a configuration or misconfiguration event, generating findings about weakened perimeter posture rather than data leaving the environment. It is tempting because it is genuinely security-relevant, but it would be correct for a firewall or misconfiguration finding category, not exfiltration.
- ✓
A large number of objects being downloaded from a Cloud Storage bucket
Why this is correct
Event Threat Detection flags exfiltration when an unusually large volume of objects is downloaded from a Cloud Storage bucket, indicating bulk data theft. This behaviour matches the exfiltration detector's data-egress heuristics rather than IAM or network findings.
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.