CCSP Cloud Security Operations Practice Question
During a forensic investigation of a suspected data exfiltration incident in AWS, a security team needs to analyze network traffic to identify the destination IP addresses and volume of data transferred. Which data source is most appropriate for this analysis?
⚠ Common exam trap
ISC2 CCSP often tests the distinction between logs that capture API-level activity (CloudTrail) versus network-level metadata (Flow Logs), and candidates mistakenly choose CloudTrail because they think 'management events' includes network traffic, but it only records control plane operations, not data plane flows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Flow Logs
VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IP addresses, ports, protocols, and the number of bytes transferred. This makes them the ideal data source for identifying the destination IP addresses and volume of data exfiltrated, as they provide per-flow byte counts and packet-level details without requiring packet capture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VPC Flow Logs
Why this is correct
VPC Flow Logs provide detailed network traffic information needed for exfiltration analysis.
- ✗
AWS Config configuration history
Why it's wrong here
Config records resource changes, not network flows.
- ✗
AWS CloudTrail management events
Why it's wrong here
CloudTrail logs API calls, not network traffic details.
- ✗
Amazon S3 access logs
Why it's wrong here
S3 access logs record requests to S3 but not general network traffic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.