The answer is communication channels for alerting stakeholders and automation playbooks for containment and eradication. These two components are critical because a cloud incident response plan must ensure that the right people are notified instantly and that automated workflows can isolate compromised resources faster than manual intervention, preventing lateral movement or data exfiltration in dynamic cloud environments. On the Certified Cloud Security Professional CCSP exam, this topic tests your understanding of how cloud-specific automation—such as AWS Lambda or Azure Automation—must be validated against live APIs to avoid breaking legitimate workloads during an incident. A common trap is focusing only on detection tools while neglecting the testing of notification paths and playbook logic, which can fail due to misconfigured IAM roles or network changes. Remember the mnemonic “CAN APE” for Communication channels and Automation Playbooks for Eradication—if you test both, your cloud response won’t escape you.
CCSP Cloud Security Operations Practice Question
This CCSP practice question tests your understanding of cloud security operations. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO of the following are key components of a cloud incident response plan that should be tested regularly?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automation playbooks for containment and eradication.
Automation playbooks for containment and eradication (B) are critical because they enable rapid, consistent response to incidents in cloud environments, where manual intervention can be too slow to prevent lateral movement or data exfiltration. Regular testing ensures these playbooks execute correctly against live cloud APIs (e.g., AWS Lambda, Azure Automation) and that they properly isolate compromised resources without disrupting legitimate workloads.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Encryption key management procedures.
Why it's wrong here
Key management is important but not a core component of incident response testing.
✓
Automation playbooks for containment and eradication.
Why this is correct
Automation playbooks must be tested to ensure they execute correctly.
Related concept
Read the scenario before looking for a memorised answer.
✓
Communication channels for alerting stakeholders.
Why this is correct
Communication channels must be tested to ensure they work during an incident.
Related concept
Read the scenario before looking for a memorised answer.
✗
Backup and restore procedures.
Why it's wrong here
Backups are part of disaster recovery, not specifically incident response testing.
✗
Service level agreements (SLAs) with cloud provider.
Why it's wrong here
SLAs are contractual, not tested as part of incident response.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between incident response plan components and broader operational or contractual elements, so candidates mistakenly select backup/restore procedures (D) or SLAs (E) because they seem related to incident handling, but they are not core to the detection, containment, and eradication phases that require regular testing.
Detailed technical explanation
How to think about this question
Automation playbooks in cloud incident response often leverage Infrastructure as Code (IaC) tools like Terraform or cloud-native orchestration (e.g., AWS Systems Manager Automation) to programmatically isolate a compromised EC2 instance by modifying security group rules or detaching it from a VPC. These playbooks must be tested against actual cloud provider rate limits (e.g., AWS API throttling at 10,000 requests per second per account) to ensure they do not fail under load during a real incident. Communication channels for alerting stakeholders (C) must be tested to verify that incident notifications reach the correct teams via multiple mediums (e.g., PagerDuty, Slack, SMS) and that they integrate with cloud monitoring services like CloudWatch Alarms or Azure Monitor, which can trigger automated responses.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Cloud Security Operations — This question tests Cloud Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Automation playbooks for containment and eradication. — Automation playbooks for containment and eradication (B) are critical because they enable rapid, consistent response to incidents in cloud environments, where manual intervention can be too slow to prevent lateral movement or data exfiltration. Regular testing ensures these playbooks execute correctly against live cloud APIs (e.g., AWS Lambda, Azure Automation) and that they properly isolate compromised resources without disrupting legitimate workloads.
What should I do if I get this CCSP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.