mediumMultiple Choice
CCSP Practice Question: Refer to the exhibit
Network Topology
Refer to the exhibit. A security analyst is investigating a potential unauthorized key pair creation. The CloudTrail log shows a successful CreateKeyPair event for an admin user. What additional step should the analyst take to determine if this was an authorized action?
⚠ Common exam trap
ISC2 often tests the misconception that the immediate response to a suspicious event should be a punitive action (like revoking privileges or deleting resources) rather than a methodical investigative step to confirm authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the source IP address against the company's approved IP ranges.
The first step in verifying whether a CreateKeyPair event was authorized is to check the source IP address against the company's approved IP ranges. CloudTrail logs include the sourceIPAddress field, which can be compared to a whitelist of administrative jump hosts or corporate VPN ranges. If the IP is outside those ranges, it strongly indicates unauthorized access, even if the user credentials were valid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately revoke all admin privileges for the user.
Why it's wrong here
Revoking admin privileges is a containment action, not an investigative step, and it destroys the ability to observe the account's ongoing behaviour. The analyst first needs to correlate the CreateKeyPair event with approved change records or tickets to establish authorisation before any remediation.
- ✗
Review the key pair's usage to see if it was used to launch instances.
Why it's wrong here
Usage of the key pair only shows whether it was later exploited; it cannot establish whether the admin's CreateKeyPair call was authorised. Correlating the event with the user's approved change requests, tickets or maintenance window is what distinguishes sanctioned activity from misuse.
- ✗
Delete the key pair immediately to prevent any misuse.
Why it's wrong here
Deleting the key pair is remediation that also destroys forensic evidence, and it presumes the action was malicious before authorisation is established. The analyst must first correlate the CreateKeyPair event with approved change requests, tickets or maintenance windows to determine whether the admin acted legitimately.
- ✓
Check the source IP address against the company's approved IP ranges.
Why this is correct
Comparing the event's source IP against approved corporate ranges establishes whether the request originated from a trusted network or an external actor, directly addressing the authorisation question. CloudTrail records the sourceIPAddress field for every CreateKeyPair event, so this check reliably distinguishes legitimate administrative activity from credential compromise or misuse.
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.