CCSP Cloud Security Operations Practice Question
During a cloud security incident, the incident response team needs to contain a compromised cloud instance. Which action should be taken FIRST to prevent further malicious activity while preserving evidence?
⚠ Common exam trap
The CCSP exam often tests the distinction between containment and preservation, and the trap here is that candidates mistakenly choose snapshot creation (Option B) as the first step, confusing forensic preservation with immediate containment, or choose role revocation (Option A) thinking it stops all activity, when it only affects API calls, not network traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the network security rule associated with the instance to deny all traffic.
Modifying the network security rule to deny all traffic immediately isolates the compromised cloud instance, preventing further malicious network activity while preserving the instance's state for forensic analysis. This containment step is reversible and does not destroy volatile data or system processes, unlike termination or snapshot creation, which can alter evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Revoke the role associated with the instance.
Why it's wrong here
Revoking the role may stop API calls but does not stop network-level activity.
- ✗
Create a snapshot of the instance volume for forensic analysis.
Why it's wrong here
Snapshot is good for evidence, but containment should come first to stop the attack.
- ✗
Terminate the instance immediately.
Why it's wrong here
Termination destroys evidence and may not stop ongoing exfiltration if other instances are involved.
- ✓
Modify the network security rule associated with the instance to deny all traffic.
Why this is correct
This isolates the instance, stopping further malicious activity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.