CCSP Cloud Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud Audit Logs

  Why it's wrong here

  Cloud Audit Logs record administrative and data-access events for later review; they are not a real-time threat-detection engine and do not correlate service-account behaviour into alerts. They are tempting because they capture service-account activity, and would be correct for compliance auditing or retrospective investigation.

• ✗

  Cloud Security Scanner

  Why it's wrong here

  Cloud Security Scanner crawls App Engine, Compute Engine and GKE web applications for common vulnerabilities such as cross-site scripting and outdated libraries; it does not analyse IAM or service-account behaviour. It is tempting as a GCP security tool, and would be correct for finding application vulnerabilities before deployment.

• ✗

  Container Threat Detection

  Why it's wrong here

  Container Threat Detection monitors GKE container workloads for runtime anomalies such as unexpected binaries or reverse shells; it does not cover service-account misuse elsewhere in the project. It is tempting as a real-time GCP detection service, and would be correct if the threat were confined to containerised workloads.

• ✓

  Event Threat Detection

  Why this is correct

  Event Threat Detection continuously analyses Cloud Audit Logs and VPC flow logs using threat intelligence to surface compromised service accounts, cryptomining and data exfiltration in near real-time. Security Command Center Premium surfaces these findings, satisfying the real-time monitoring requirement that Cloud Logging alone cannot provide.