Courseiva

CCNA Ccsp Security Ops Questions

70 questions · Ccsp Security Ops topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
Multi-Selectmedium

A security analyst is configuring Azure Defender for Cloud to protect a hybrid environment. Which THREE resource types can be protected by enabling Azure Defender plans? (Choose three.)

Select 3 answers
A.Azure SQL databases (Defender for Databases)
B.Azure Key Vault (Defender for Key Vault)
C.Azure AD identities
D.Virtual machines (Defender for Servers)
E.Azure DNS zones
AnswersA, B, D

Defender for Databases covers SQL and other database types.

Why this answer

Azure Defender for Cloud provides integrated security protections for Azure resources. Enabling the 'Defender for Databases' plan specifically protects Azure SQL databases by detecting anomalous activities, SQL injection attempts, and potential vulnerabilities. This plan extends to other database types like Azure SQL Managed Instance and Azure Synapse SQL pools, ensuring comprehensive database security.

Exam trap

Candidates often confuse Azure Defender plans (which protect specific resource types like VMs, databases, and Key Vault) with other Azure security services (like Azure AD Identity Protection or Azure DNS security features), leading them to incorrectly select Azure AD identities or DNS zones as protected resources.

Practice this question →
2
MCQhard

A cloud security team implements correlation rules in their SIEM to detect 'impossible travel' scenarios. Which combination of log sources is essential for detecting a user logging in from two different countries within a short time frame?

A.Amazon GuardDuty findings and Security Hub
B.AWS Config history and resource inventory
C.CloudTrail management events and AWS CloudTrail authentication events
D.VPC Flow Logs and DNS logs
AnswerC

CloudTrail logs include console login events with source IP; combining with timestamps allows impossible travel detection.

Why this answer

Detecting impossible travel requires authentication logs (who logged in and from where) and timestamps. Cloud provider authentication logs (e.g., AWS CloudTrail for console logins, Azure AD sign-in logs) provide the necessary data.

Practice this question →
3
MCQmedium

A security engineer needs to automate the remediation of any S3 bucket that is publicly accessible. The solution should work within a single AWS account and not require manual intervention. Which combination of services is MOST appropriate?

A.AWS Config rule + AWS Lambda auto-remediation
B.Amazon GuardDuty + AWS Step Functions
C.AWS CloudTrail + Amazon SNS
D.AWS Trusted Advisor + AWS Systems Manager
AnswerA

Config detects, Lambda remediates.

Why this answer

AWS Config can continuously evaluate S3 bucket settings against a custom or managed rule (e.g., s3-bucket-public-read-prohibited). When the rule detects a noncompliant bucket, it triggers an AWS Lambda function via auto-remediation, which can modify the bucket's ACL or policy to remove public access. This combination provides fully automated, event-driven remediation without manual steps.

Exam trap

In the CCSP exam context, candidates often confuse detection services (GuardDuty, CloudTrail) with configuration enforcement services (AWS Config), leading them to select a solution that only detects but does not remediate public S3 buckets.

How to eliminate wrong answers

Option B is wrong because Amazon GuardDuty is a threat detection service that identifies malicious activity (e.g., unusual API calls), not a configuration compliance tool; it cannot directly enforce S3 bucket policies. Option C is wrong because AWS CloudTrail records API activity but does not evaluate or remediate configurations, and Amazon SNS only sends notifications, not automated fixes. Option D is wrong because AWS Trusted Advisor provides best-practice checks and recommendations, but it does not offer native auto-remediation; AWS Systems Manager can automate actions but requires custom runbooks and is not designed for real-time S3 bucket compliance enforcement.

Practice this question →
4
MCQmedium

A security team is configuring AWS CloudTrail to enable detection of unauthorized API calls. They want to ensure that log files cannot be tampered with after delivery. Which CloudTrail feature should they enable?

A.CloudTrail Insights
B.CloudTrail Log File Validation
C.CloudTrail Multi-Region Trail
D.CloudTrail Event History
AnswerB

This feature creates a signed digest file for each log file, enabling integrity verification.

Why this answer

CloudTrail Log File Validation (option B) uses a SHA-256 hash chain to create a digital signature for each log file, enabling integrity verification. When enabled, CloudTrail delivers digest files that contain hashes of log files, allowing you to confirm that log files were not modified, deleted, or tampered with after delivery. This directly addresses the requirement to detect unauthorized API calls by ensuring the logs themselves are trustworthy.

Exam trap

Candidates often mistake CloudTrail Insights (which detects unusual patterns) for a tamper-detection feature, but only Log File Validation provides cryptographic integrity verification of log files.

How to eliminate wrong answers

Option A is wrong because CloudTrail Insights identifies unusual API activity and potential misuse, but it does not provide any mechanism to validate the integrity of log files after delivery. Option C is wrong because a multi-region trail aggregates logs from all AWS regions into a single trail, which improves visibility but does not protect against tampering of delivered log files. Option D is wrong because CloudTrail Event History provides a view of the last 90 days of management events for a region, but it is a read-only record and does not include any file validation or integrity checks.

Practice this question →
5
MCQhard

A security analyst is investigating a potential breach and needs to verify the integrity of audit logs stored in cloud storage. Which feature should the analyst rely on to confirm that logs have not been tampered with?

A.Server-side encryption of logs
B.Log file integrity validation
C.Anomaly detection on logs
D.Immutable storage for logs
AnswerB

Log file validation uses cryptographic hashing and digital signatures to verify that log files have not been modified after delivery.

Why this answer

Integrity verification of audit logs is typically achieved through cryptographic hashing (e.g., SHA-256) and digital signatures provided by the cloud service provider's logging service. This allows the analyst to confirm that logs have not been altered since they were created.

Exam trap

Candidates may confuse integrity verification with encryption or access control. Log file validation specifically provides hash-based integrity, not just confidentiality or retention.

Practice this question →
6
MCQeasy

Which AWS service uses machine learning to detect threats such as crypto mining activity on EC2 instances and compromised IAM credentials?

A.AWS Shield
B.AWS WAF
C.AWS Inspector
D.Amazon GuardDuty
AnswerD

GuardDuty uses ML to detect threats like crypto mining and credential compromise.

Why this answer

Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify malicious activity.

Practice this question →
7
MCQeasy

An organization uses a cloud security monitoring service for threat detection. A finding indicates that a virtual machine instance is communicating with a known cryptocurrency mining pool. What type of threat does this represent?

A.Reconnaissance port scanning
B.Ransomware activity
C.Compromised credentials exfiltration
D.Crypto mining on a virtual machine
AnswerD

GuardDuty can detect EC2 instances generating traffic to known mining pools.

Why this answer

A cloud security monitoring service detects threats by analyzing network traffic logs, DNS logs, and API call logs. A finding of communication with a known cryptocurrency mining pool indicates that the virtual machine instance is likely compromised and running crypto mining software, which consumes excessive compute resources and represents a malicious activity type known as crypto mining.

Exam trap

The trap here is that candidates confuse crypto mining with ransomware or credential theft, but the key differentiator is the specific network communication pattern to a mining pool, not data encryption or API abuse.

How to eliminate wrong answers

Option A is wrong because reconnaissance port scanning involves probing for open ports or services, not communication with a known mining pool, which is a specific outbound connection to a malicious IP/domain. Option B is wrong because ransomware activity typically involves encrypting data and demanding payment, not the sustained CPU usage and network traffic to mining pools characteristic of crypto mining. Option C is wrong because compromised IAM credentials exfiltration would manifest as unauthorized API calls or access to sensitive resources, not direct outbound connections to mining infrastructure.

Practice this question →
8
MCQhard

During a security incident in GCP, a forensic analyst needs to determine the exact timeline of events leading to a credential compromise. Which log source provides the most detailed information about IAM policy changes and authentication events?

A.VPC Flow Logs
B.Cloud Audit Logs
C.Cloud DNS logs
D.Cloud Monitoring metrics
AnswerB

Cloud Audit Logs capture all API calls including IAM modifications and authentication events.

Why this answer

GCP Cloud Audit Logs record all admin activities and data access, including IAM changes and authentication, making them the best source for timeline reconstruction.

Practice this question →
9
Multi-Selecthard

An organization is implementing automated remediation for common cloud security misconfigurations using AWS Config and Lambda. Which THREE misconfigurations can be automatically remediated using this approach?

Select 3 answers
A.S3 bucket with public read access
B.EBS volume without encryption
C.EC2 instance type not compliant with corporate standard
D.VPC with default security group allowing all traffic
E.Security group allowing SSH from 0.0.0.0/0
AnswersA, B, E

A Lambda can modify the bucket policy to remove public access.

Why this answer

AWS Config can evaluate S3 bucket public read access against a managed rule (s3-bucket-public-read-prohibited) and trigger a Lambda function to apply a bucket policy that blocks public access. This is a common automated remediation pattern because the fix is deterministic and can be applied via the AWS SDK without manual intervention.

Exam trap

Automated remediation is most suitable for deterministic fixes that do not require manual intervention or cause downtime, such as applying bucket policies or modifying security group rules, as opposed to changes that affect instance state (e.g., instance type modification) or require manual review (e.g., default security group modifications).

Practice this question →
10
MCQmedium

During a cloud security incident, the incident response team needs to contain a compromised cloud instance. Which action should be taken FIRST to prevent further malicious activity while preserving evidence?

A.Revoke the role associated with the instance.
B.Create a snapshot of the instance volume for forensic analysis.
C.Terminate the instance immediately.
D.Modify the network security rule associated with the instance to deny all traffic.
AnswerD

This isolates the instance, stopping further malicious activity.

Why this answer

Modifying the network security rule to deny all traffic immediately isolates the compromised cloud instance, preventing further malicious network activity while preserving the instance's state for forensic analysis. This containment step is reversible and does not destroy volatile data or system processes, unlike termination or snapshot creation, which can alter evidence.

Exam trap

The CCSP exam often tests the distinction between containment and preservation, and the trap here is that candidates mistakenly choose snapshot creation (Option B) as the first step, confusing forensic preservation with immediate containment, or choose role revocation (Option A) thinking it stops all activity, when it only affects API calls, not network traffic.

How to eliminate wrong answers

Option A is wrong because revoking the IAM role stops API-level access but does not block network traffic to or from the instance, so ongoing malicious network activity (e.g., data exfiltration or lateral movement) continues unimpeded. Option B is wrong because creating a snapshot is a forensic preservation step that should occur after containment, not first; the snapshot captures the disk state but does not stop active malicious traffic or processes. Option C is wrong because terminating the instance immediately destroys volatile memory, running processes, and network connections, which are critical for forensic analysis and may violate chain-of-custody requirements.

Practice this question →
11
MCQhard

During incident response in a cloud environment, a team needs to collect evidence from a compromised EC2 instance without altering the system. Which of the following is the best method to obtain a forensic memory dump?

A.Create an AMI of the instance
B.Enable detailed billing reports
C.Use the AWS CLI to execute a memory dump script on the instance (e.g., via AWS Systems Manager Run Command)
D.Take a snapshot of the root EBS volume
AnswerC

This option directly involves obtaining a memory dump. Although the CLI command is not standard, it represents the correct intent to capture RAM.

Why this answer

To obtain a forensic memory dump from a compromised EC2 instance without rebooting or altering the disk state, you can use the AWS CLI to invoke a command that runs a memory acquisition tool, such as LiME or AVML. For example, you could send a command via AWS Systems Manager Run Command to dump memory to an S3 bucket for analysis. Options A and D capture non-volatile disk states (AMI and EBS snapshot), and Option B is unrelated to evidence collection.

Therefore, Option C is the best choice.

Practice this question →
12
MCQeasy

An organization uses a cloud-based SIEM solution. Which cloud service provides native integration to stream audit logs into the SIEM?

A.Security monitoring service
B.Centralized logging service
C.Policy management service
D.Recommendation service
AnswerB

Correct. The centralized logging service is designed to collect and stream logs, including audit logs, to a SIEM for analysis.

Why this answer

The centralized logging service can stream audit logs directly to the SIEM via connectors. Many cloud providers offer this native integration, allowing organizations to aggregate and analyze log data centrally.

Practice this question →
13
MCQmedium

An organization uses Azure Defender for Cloud to protect their hybrid environment. They want to receive alerts about suspicious activities on their Azure Key Vault. Which Defender plan should they enable?

A.Defender for Databases
B.Defender for Containers
C.Defender for Servers
D.Defender for Key Vault
AnswerD

Specifically protects Key Vault.

Why this answer

Defender for Key Vault is the specific plan designed to provide advanced threat protection for Azure Key Vault. It monitors access patterns and operations on the vault to detect suspicious activities such as unauthorized access attempts, credential theft, or anomalous secret retrieval, and generates security alerts accordingly.

Exam trap

A common trap is that candidates may assume a general plan like Defender for Servers covers all Azure services, but each Defender plan is scoped to a specific service category, such as Defender for Key Vault for Key Vault security.

How to eliminate wrong answers

Option A is wrong because Defender for Databases protects Azure SQL, SQL Server on VMs, and other database services, not Key Vault. Option B is wrong because Defender for Containers secures containerized environments like AKS, ACR, and Kubernetes workloads, not Key Vault. Option C is wrong because Defender for Servers provides threat detection for virtual machines and on-premises servers, not for Key Vault.

Practice this question →
14
Multi-Selecthard

A cloud security team is designing an incident response playbook for a suspected data exfiltration via an AWS S3 bucket. Which TWO actions should be included for containment and evidence collection? (Choose two.)

Select 2 answers
A.Immediately notify all users to change passwords.
B.Revoke IAM credentials associated with the compromised access.
C.Take a snapshot of the S3 bucket using AWS Backup.
D.Enable VPC Flow Logs for the VPC where the bucket is accessed.
E.Delete the S3 bucket to prevent further access.
AnswersB, D

Stops further API calls.

Why this answer

For containment, revoking the IAM credentials used by the attacker stops further access. For evidence, enabling VPC Flow Logs (if not already enabled) captures network traffic for analysis.

Practice this question →
15
MCQmedium

A security engineer is evaluating vulnerability management options for cloud workloads and wants to identify vulnerabilities without installing agents on the operating system. Which approach should be used?

A.Network-based vulnerability scanning
B.Agentless scanning using cloud API-based assessment
C.Agent-based scanning using a cloud-specific vulnerability scanner
D.Container image scanning in a registry
AnswerB

Agentless scanning leverages cloud APIs to assess vulnerabilities without an agent.

Why this answer

Agentless scanning leverages cloud provider APIs (e.g., for configuration and asset inventory) to assess the configuration and patch state of cloud workloads without requiring an OS-level agent. This approach directly meets the requirement of identifying vulnerabilities without installing agents on the operating system, as it reads metadata and configuration snapshots from the cloud control plane.

Exam trap

The trap here is that candidates often confuse 'agentless scanning' with 'network-based scanning,' assuming that any scan without an OS agent must be network-based, but the CCSP exam specifically tests the cloud-native API-driven assessment model as the correct agentless approach for cloud workloads.

How to eliminate wrong answers

Option A is wrong because network-based vulnerability scanning (e.g., Nmap, Nessus) requires network connectivity and often relies on OS fingerprinting or banner grabbing, but it cannot reliably assess internal OS-level vulnerabilities (e.g., missing patches, registry misconfigurations) without agent-based or authenticated access, and it still does not avoid the need for some form of OS interaction. Option C is wrong because agent-based scanning using AWS Inspector explicitly requires installing an agent on the EC2 instance to collect OS-level telemetry, which contradicts the requirement to avoid agents. Option D is wrong because container image scanning in a registry (e.g., Amazon ECR scanning, Trivy) only analyzes static images at rest, not running cloud workloads, and does not address vulnerabilities in the OS of running instances or virtual machines.

Practice this question →
16
Multi-Selecthard

During a cloud incident response, the security team needs to eradicate a malicious Lambda function that was created by an attacker. Which THREE steps should be part of the eradication process? (Choose three.)

Select 3 answers
A.Delete the Lambda function
B.Review and remove any CloudWatch Events triggers
C.Revoke any IAM roles associated with the function
D.Disable CloudTrail logging in the affected region
E.Place the function in a quarantine VPC
AnswersA, B, C

This removes the malicious code.

Why this answer

Deleting the Lambda function is a direct eradication step because it removes the attacker's malicious code from the AWS environment. Once deleted, the function can no longer be invoked, and any associated execution logs or metrics will cease. This action is irreversible and ensures the attacker's foothold is eliminated.

Exam trap

CCSP often tests the misconception that placing a resource in a quarantine network (like a VPC) is sufficient for containment, but in serverless environments, the function's code and execution permissions remain active, so deletion and role revocation are mandatory.

Practice this question →
17
MCQmedium

A security team is implementing vulnerability management in a hybrid cloud environment. They need to scan virtual machines without installing an agent. Which approach is most suitable?

A.Deploying a third-party vulnerability scanner on each VM
B.Agentless scanning using cloud APIs
C.Agent-based scanning with AWS Inspector
D.Using container image scanning in registry
AnswerB

Agentless scanning leverages cloud provider APIs to assess VM vulnerabilities.

Why this answer

Agentless scanning using cloud APIs (Option B) is the correct approach because it allows the security team to scan virtual machines without installing any software on the VMs themselves. This method leverages cloud provider APIs (e.g., AWS EC2 DescribeInstances, Azure VM REST APIs) to query the hypervisor or management plane for VM configurations, patch levels, and vulnerabilities, making it ideal for hybrid cloud environments where agent deployment may be impractical or restricted.

Exam trap

The trap here is that candidates often confuse 'agentless scanning' with 'agent-based scanning' or assume that container image scanning applies to VMs, but ISC2 tests the specific requirement of scanning VMs without installing an agent, which only agentless cloud API-based scanning satisfies.

How to eliminate wrong answers

Option A is wrong because deploying a third-party vulnerability scanner on each VM requires installing an agent, which directly contradicts the requirement to scan without installing an agent. Option C is wrong because agent-based scanning with AWS Inspector requires the AWS Systems Manager Agent (SSM Agent) to be installed on each EC2 instance, which is an agent-based approach. Option D is wrong because container image scanning in a registry (e.g., Amazon ECR scanning) is designed for container images, not for virtual machines, and does not address the requirement to scan VMs.

Practice this question →
18
MCQhard

During a forensic investigation of a suspected data exfiltration incident in AWS, a security team needs to analyze network traffic to identify the destination IP addresses and volume of data transferred. Which data source is most appropriate for this analysis?

A.VPC Flow Logs
B.AWS Config configuration history
C.AWS CloudTrail management events
D.Amazon S3 access logs
AnswerA

VPC Flow Logs provide detailed network traffic information needed for exfiltration analysis.

Why this answer

VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IP addresses, ports, protocols, and the number of bytes transferred. This makes them the ideal data source for identifying the destination IP addresses and volume of data exfiltrated, as they provide per-flow byte counts and packet-level details without requiring packet capture.

Exam trap

ISC2 CCSP often tests the distinction between logs that capture API-level activity (CloudTrail) versus network-level metadata (Flow Logs), and candidates mistakenly choose CloudTrail because they think 'management events' includes network traffic, but it only records control plane operations, not data plane flows.

How to eliminate wrong answers

Option B (AWS Config configuration history) is wrong because it records resource configuration changes (e.g., security group rules, instance types) over time, not network traffic or data transfer volumes. Option C (AWS CloudTrail management events) is wrong because it logs API calls that modify AWS resources (e.g., CreateInstance, AuthorizeSecurityGroupIngress), not the actual network packets or byte counts flowing through the VPC. Option D (Amazon S3 access logs) is wrong because they only log requests made to S3 buckets (e.g., GET, PUT, DELETE operations) and do not capture general VPC network traffic or destination IP addresses for exfiltration outside of S3 interactions.

Practice this question →
19
MCQeasy

A cloud security team wants to automatically detect and remediate S3 buckets that are publicly accessible. Which combination of AWS services can achieve this?

A.Amazon Inspector and AWS Security Hub
B.AWS WAF and Amazon Route 53
C.AWS Config and AWS Lambda
D.AWS CloudTrail and Amazon GuardDuty
AnswerC

Config evaluates rules and can invoke Lambda for auto-remediation.

Why this answer

AWS Config continuously evaluates S3 bucket configurations against rules (e.g., s3-bucket-public-read-prohibited) and can trigger an AWS Lambda function via Amazon EventBridge when a non-compliant change is detected. The Lambda function then automatically applies a remediation action, such as removing the public access block or updating the bucket policy, achieving automated detection and remediation without manual intervention.

Exam trap

This question tests the distinction between detection-only services (like Inspector, GuardDuty, CloudTrail) and services that can both detect and trigger automated remediation (Config + Lambda), leading candidates to pick a service that only detects but cannot remediate.

How to eliminate wrong answers

Option A is wrong because Amazon Inspector is a vulnerability assessment service for EC2 instances and container workloads, not for S3 bucket configuration monitoring; Security Hub aggregates findings from other services but does not directly detect or remediate S3 public access. Option B is wrong because AWS WAF is a web application firewall that protects against web exploits at the application layer (HTTP/HTTPS), not for S3 bucket-level access controls; Route 53 is a DNS service and has no role in S3 bucket policy evaluation. Option D is wrong because AWS CloudTrail records API activity (e.g., PutBucketPolicy) but does not evaluate current bucket configurations for public access, and Amazon GuardDuty detects threats like suspicious API calls or compromised credentials, not misconfigured bucket permissions.

Practice this question →
20
Multi-Selecteasy

A cloud security engineer needs to ensure that logs from multiple AWS accounts are centrally stored in a security account for analysis. Which TWO services can be used to aggregate logs across accounts? (Choose two.)

Select 2 answers
A.Amazon CloudWatch Logs with cross-account subscription filters
B.AWS Config
C.AWS Security Hub
D.Amazon S3 with cross-account bucket policies
E.Amazon GuardDuty
AnswersA, D

CloudWatch Logs can forward log events to a central account via subscription filters.

Why this answer

Amazon CloudWatch Logs supports cross-account subscription filters, which allow you to stream log data from log groups in multiple source accounts to a single destination (e.g., a Kinesis stream or Lambda function) in a central security account. This enables real-time aggregation of logs across accounts. Amazon S3 with cross-account bucket policies allows you to write logs from multiple accounts to a central S3 bucket by granting write permissions to source accounts via bucket policies.

Both services can aggregate logs across accounts, while AWS Config, Security Hub, and GuardDuty aggregate configuration items and security findings, not raw logs.

Exam trap

A common trap is mixing up services that aggregate raw logs (CloudWatch Logs, S3) with those that aggregate security findings or metadata (Security Hub, GuardDuty). Candidates may incorrectly select Security Hub or GuardDuty for log aggregation.

Practice this question →
21
MCQmedium

A security team wants to detect when the root user account is used in a cloud environment. Which service can generate an alert for this activity?

A.Activity logging service
B.Configuration monitoring service
C.Security posture management service
D.Threat detection service
AnswerD

A threat detection service continuously monitors for malicious behavior, including root user activity, and can generate alerts directly.

Why this answer

A threat detection service is designed to continuously monitor for malicious or unauthorized behavior, including the use of the root user account. It uses machine learning and integrated threat intelligence to generate findings for such activities, which can then trigger alerts via event notification services. This makes it the correct choice for detecting root user usage.

Exam trap

The trap here is that candidates often confuse an activity logging service’s logging capability with alerting, assuming it can directly generate alerts, when in fact it only records events and requires integration with other services for notification.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail is a logging service that records API calls, but it does not natively generate alerts; it requires additional services like CloudWatch Alarms or EventBridge to create alerts for root user activity. Option B is wrong because AWS Config is a configuration management and compliance service that evaluates resource configurations against rules, not a threat detection service, and it cannot directly detect root user login events. Option C is wrong because AWS Security Hub aggregates findings from multiple services (like GuardDuty) and provides a centralized view, but it does not generate its own alerts for root user activity; it relies on other services to produce those findings.

Practice this question →
22
MCQhard

During a cloud incident response, a security team needs to collect memory from a compromised EC2 instance for forensic analysis. Which method is most appropriate for acquiring a memory dump?

A.Analyze CloudTrail logs for the instance's API calls.
B.Take a snapshot of the EBS volumes attached to the instance.
C.Review VPC Flow Logs for network traffic.
D.Use AWS Systems Manager to run a memory acquisition script on the instance.
AnswerD

Systems Manager can execute commands to capture memory using tools like LiME.

Why this answer

Memory (RAM) is volatile and not captured by disk snapshots or logs. Collecting a memory dump requires live forensic acquisition while the instance is running. AWS Systems Manager (SSM) allows remote execution of scripts, such as a memory capture tool (e.g., LiME or DumpIt), on the target instance.

This method is efficient, forensically sound, and minimizes disruption. CloudTrail logs API calls, not memory. EBS snapshots only capture persistent storage.

VPC Flow Logs record network metadata, not memory content. Therefore, D is the correct answer.

Exam trap

Many candidates incorrectly assume that an EBS snapshot captures memory because it includes the swap file. However, the swap file only holds pages swapped out of RAM; active memory contents are not captured. Only live acquisition tools can collect a full memory dump.

Practice this question →
23
MCQeasy

Which of the following is a primary purpose of a SOAR (Security Orchestration, Automation and Response) platform in cloud security operations?

A.To automate response to security incidents by executing predefined playbooks.
B.To provide a centralized dashboard for cloud cost management.
C.To scan container images for vulnerabilities.
D.To enforce identity and access management policies.
AnswerA

SOAR automates incident response workflows.

Why this answer

SOAR platforms automate incident response processes, orchestrating actions across multiple tools and reducing manual effort.

Exam trap

Candidates often confuse SOAR with SIEM; SOAR focuses on automated orchestration and response, while SIEM provides log analysis and alerting.

Practice this question →
24
MCQmedium

A company uses Azure and wants to ensure that all activity log events are retained for seven years to meet compliance requirements. What is the most efficient way to implement this?

A.Export activity logs to an Azure Storage account and apply a lifecycle management policy to delete logs after 7 years.
B.Enable Azure Monitor and configure the activity log to be stored in a Log Analytics workspace with a retention of 7 years.
C.Use Azure Backup to back up activity logs and retain them for 7 years.
D.Configure activity logs to be sent to an Event Hub and then to a third-party archival service.
AnswerA

Storage accounts can hold logs for any duration with lifecycle policies to manage retention.

Why this answer

Azure Monitor Activity Logs can be streamed to a storage account, and a lifecycle management policy can be applied to automatically delete logs after the required retention period.

Practice this question →
25
MCQhard

A security team is investigating a potential data exfiltration incident where a large volume of data was downloaded from a cloud storage bucket. Which log source would provide the most granular details about the GET requests, including the requester identity and source IP?

A.VPC flow logs
B.Cloud storage access logs
C.Cloud management events (e.g., CloudTrail equivalent)
D.Log aggregation service for storage (e.g., CloudWatch equivalent)
AnswerB

Object storage access logs record detailed information about each read (GET) request, including the requester identity, source IP, and object accessed.

Why this answer

Cloud storage access logs provide detailed records of requests made to a bucket, including requester, source IP, and objects accessed. Cloud audit logs (data events) can also log storage operations, but storage access logs are more granular for this purpose.

Practice this question →
26
MCQmedium

An organization is implementing a cloud SIEM solution to centralize security monitoring across multiple AWS accounts. Which service should be used to aggregate security findings and send them to a third-party SIEM like Splunk?

A.AWS CloudTrail
B.AWS Security Hub
C.AWS GuardDuty
D.AWS Config
AnswerB

Security Hub is designed to aggregate and prioritize security findings from across AWS accounts and services.

Why this answer

AWS Security Hub is the correct service because it is designed to aggregate security findings from multiple AWS services (e.g., GuardDuty, Inspector, Macie) and AWS accounts, and then forward them to third-party SIEM solutions like Splunk via AWS EventBridge or direct integration. This centralizes security alerts into a single dashboard and stream, enabling efficient monitoring across a multi-account environment.

Exam trap

CCSP often tests the distinction between services that generate findings (like GuardDuty) versus services that aggregate and normalize findings (like Security Hub), leading candidates to pick GuardDuty because they confuse detection with centralization.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity logs, not security findings, and it does not aggregate findings across accounts or natively forward to a SIEM. Option C is wrong because AWS GuardDuty is a threat detection service that generates findings, but it cannot aggregate findings from multiple accounts or services; it relies on Security Hub for centralization. Option D is wrong because AWS Config tracks resource configuration changes and compliance, not security findings, and it lacks the aggregation and SIEM forwarding capabilities of Security Hub.

Practice this question →
27
Multi-Selecthard

An organization is designing an incident response playbook for a compromised AWS IAM user. Which THREE actions should be included in the containment phase? (Choose three.)

Select 3 answers
A.Disable the user's access keys.
B.Take a snapshot of all EC2 instances for forensic analysis.
C.Attach an IAM policy that denies all actions to the user.
D.Terminate any EC2 instances launched by the user.
E.Revoke the user's IAM credentials.
AnswersA, C, E

Disabling access keys prevents further programmatic access.

Why this answer

Containment involves stopping the attacker's access. Revoking credentials, disabling the user's access keys, and attaching a deny-all policy are effective containment steps. Terminating resources is eradication, and taking snapshots is evidence collection.

Practice this question →
28
MCQhard

During a cloud security incident, the response team needs to collect evidence from a compromised AWS EC2 instance. Which method is most appropriate for capturing volatile data while preserving forensic integrity?

A.Terminate the instance and launch a replacement
B.Create a memory dump by SSH and save to S3
C.Take an EBS snapshot of the instance's volumes
D.Reboot the instance and collect logs
AnswerB

Correct. A memory dump captures volatile data (RAM), and SSH is a common remote access method for initiating the dump. Saving to S3 provides secure storage. Although SSH modifies state, it is the best practical option for volatile data capture in cloud environments.

Why this answer

The most appropriate method for capturing volatile data (memory) from a compromised EC2 instance. Using SSH to perform a memory dump (e.g., via LiME or fmem) and saving the output to S3 captures RAM contents, which is volatile and critical for incident response. While SSH access alters system state, it is the standard approach for remote memory acquisition when direct physical access is unavailable.

Option C (EBS snapshot) captures persistent storage, not volatile memory, so it is incorrect for the stated requirement.

Exam trap

A common trap is that while SSH access does alter system state, in cloud environments remote memory acquisition via SSH is often the only feasible method to capture volatile data. Candidates may incorrectly rule out this option due to strict forensic standards, but it is the most appropriate choice given the constraints.

How to eliminate wrong answers

Option A is wrong because terminating the instance destroys all volatile data (memory, process state) and may trigger cleanup scripts that overwrite evidence, violating forensic preservation. Option B is wrong because SSHing into the instance to create a memory dump modifies the system state (e.g., writes to disk, changes process tables) and the dump file itself alters the evidence chain; memory acquisition should be done via hypervisor-level tools like LiME or AWS Nitro's memory capture, not over SSH. Option D is wrong because rebooting the instance clears RAM and resets kernel data structures, losing all volatile evidence such as running processes, network connections, and encryption keys.

Practice this question →
29
MCQeasy

What is the primary purpose of cloud security posture management (CSPM) tools?

A.To provide a centralized log storage solution.
B.To detect real-time threats like malware and intrusions.
C.To manage user identities and access permissions.
D.To assess and improve the security configuration of cloud resources against benchmarks.
AnswerD

CSPM focuses on configuration and compliance.

Why this answer

CSPM tools are designed to continuously monitor cloud environments, assess configurations against industry benchmarks (e.g., CIS, NIST, PCI DSS), and provide remediation guidance. Their primary purpose is to identify misconfigurations and compliance gaps, not to perform real-time threat detection or centralized logging.

Exam trap

ISC2 CCSP often tests the distinction between CSPM (configuration assessment) and other security tools (e.g., SIEM, IDS/IPS, IAM), so the trap here is confusing CSPM's proactive compliance monitoring with reactive threat detection or log management.

How to eliminate wrong answers

Option A is wrong because centralized log storage is the function of services like AWS CloudTrail, Azure Monitor, or GCP Cloud Logging, not CSPM tools which focus on configuration assessment. Option B is wrong because real-time threat detection for malware and intrusions is handled by dedicated security tools like AWS GuardDuty, Azure Defender, or GCP Threat Detection, whereas CSPM tools are configuration-focused and not designed for active threat hunting. Option C is wrong because managing user identities and access permissions is the role of IAM services (e.g., AWS IAM, Azure AD, GCP IAM), not CSPM tools which evaluate the security posture of resources but do not directly manage identities or permissions.

Practice this question →
30
MCQhard

During a cloud incident response, a security team needs to isolate a compromised EC2 instance to prevent further communication with an external command-and-control server. Which step should be taken first?

A.Take a forensic snapshot of the instance’s EBS volume
B.Revoke the IAM credentials associated with the instance’s role
C.Stop the EC2 instance
D.Modify the security group to deny all outbound traffic
AnswerD

This immediately stops all network communication from the instance.

Why this answer

Modifying the security group to deny all outbound traffic is the fastest way to cut communication between the compromised EC2 instance and the external C2 server without destroying volatile data. Security groups act as a stateful virtual firewall at the instance level, and changing the outbound rule to deny all traffic immediately blocks any existing or new connections to the C2 IP. This preserves the instance's runtime state for later forensic analysis while containing the threat.

Exam trap

In cloud incident response, it's important to distinguish between containment (blocking network traffic) and preservation (snapshotting or stopping). A common trap is that candidates mistakenly choose 'Stop the EC2 instance' thinking it is the most definitive containment action, not realizing it destroys volatile evidence and is slower to implement than a security group change.

How to eliminate wrong answers

Option A is wrong because taking a forensic snapshot of the EBS volume is a preservation step that should occur after containment, not first; it does not stop active C2 communication. Option B is wrong because revoking IAM credentials prevents the instance from making API calls to AWS services but does not block network-layer traffic to an external C2 server, which operates at the IP/port level. Option C is wrong because stopping the EC2 instance would terminate the operating system and lose volatile memory (RAM) evidence, and it is a more disruptive action than simply blocking outbound traffic via security group rules.

Practice this question →
31
Multi-Selectmedium

An organization is using GCP and wants to implement cloud security posture management (CSPM) to continuously monitor configurations against the CIS Benchmark. Which TWO GCP services can be used for this purpose? (Choose two.)

Select 2 answers
A.Cloud VPN
B.Cloud Asset Inventory
C.Security Command Center
D.Cloud Audit Logs
E.Cloud Functions
AnswersB, C

Provides a complete view of resources and can be used for compliance checks.

Why this answer

Cloud Asset Inventory provides a historical view of all GCP resources and their configurations, enabling continuous monitoring against compliance frameworks like the CIS Benchmark. Security Command Center offers built-in CSPM capabilities, including automated scanning for CIS Benchmark violations and actionable recommendations to remediate misconfigurations.

Exam trap

The CCSP exam often tests the distinction between logging services (Cloud Audit Logs) and active monitoring/compliance services (CSPM), leading candidates to mistakenly choose Cloud Audit Logs for configuration monitoring instead of Security Command Center or Cloud Asset Inventory.

Practice this question →
32
MCQeasy

An organization is using GCP and wants to collect audit logs for all API calls made within the project. Which GCP service should be enabled to capture these logs?

A.VPC Flow Logs
B.Cloud Audit Logs
C.Cloud Monitoring
D.Cloud Security Command Center
AnswerB

Cloud Audit Logs record all API calls and are enabled by default for many services.

Why this answer

GCP Cloud Audit Logs record administrative activities and data access within GCP projects. They are the primary source for API call logging. Security Command Center provides security and risk management but does not generate audit logs.

Cloud Monitoring collects metrics and uptime checks. VPC Flow Logs capture network traffic, not API calls.

Practice this question →
33
MCQmedium

An organization wants to ensure that all resources are compliant with CIS benchmarks. Which cloud service provides a unified view of compliance posture and recommendations?

A.Security Information and Event Management (SIEM) tool
B.Cloud Security Posture Management (CSPM) tool
C.Cloud monitoring and logging service
D.Policy-as-code enforcement service
AnswerB

Correct. A CSPM tool provides a unified compliance score and recommendations.

Why this answer

A cloud security posture management (CSPM) tool provides a unified, centralized view of an organization's security and compliance posture, including specific recommendations aligned with CIS benchmarks. It aggregates findings from various security controls into a single score and actionable guidance, making it the correct service for monitoring compliance against CIS standards.

Exam trap

The trap here is that candidates confuse a policy enforcement service (which enforces rules) with a cloud security posture management (CSPM) tool (which provides the unified compliance posture and scoring), or they mistakenly think cloud monitoring and logging or SIEM services can serve as a compliance dashboard when they are designed for other purposes.

How to eliminate wrong answers

Option A is wrong because Azure Sentinel is a cloud-native SIEM/SOAR solution focused on threat detection, investigation, and response, not on providing a unified compliance posture view or CIS benchmark recommendations. Option C is wrong because Azure Monitor collects and analyzes telemetry data (metrics, logs) for performance and health monitoring, but it does not natively aggregate compliance posture or provide CIS benchmark-specific recommendations. Option D is wrong because Azure Policy enforces and audits compliance rules (e.g., tagging, allowed locations) but does not present a unified, scored compliance posture view; it is a building block that feeds into Secure Score, not the unified dashboard itself.

Practice this question →
34
MCQhard

An organization uses GCP and wants to detect container threats such as privilege escalation attempts within Kubernetes Engine. Which GCP service is designed specifically for this purpose?

A.Container Threat Detection
B.Cloud Security Scanner
C.Event Threat Detection
D.Cloud Audit Logs
AnswerA

Container Threat Detection is a service within Security Command Center for GKE threats.

Why this answer

Container Threat Detection (CTD) is a GCP service purpose-built to identify threats within Google Kubernetes Engine (GKE) containers, including privilege escalation attempts, by analyzing runtime behavior and Kubernetes audit logs. It uses machine learning and rule-based detection to spot anomalies like container breakout, unauthorized system calls, and attempts to escalate privileges via capabilities or security contexts. This makes it the correct choice for detecting container-specific threats in GKE.

Exam trap

ISC2 often tests the distinction between general threat detection services (like Event Threat Detection) and container-specific services (like Container Threat Detection), so candidates may confuse Event Threat Detection as covering all cloud threats, missing that it does not analyze container runtime behavior.

How to eliminate wrong answers

Option B (Cloud Security Scanner) is wrong because it is designed to scan web applications for vulnerabilities like XSS and SQL injection, not to detect runtime container threats or privilege escalation in Kubernetes. Option C (Event Threat Detection) is wrong because it focuses on identifying threats from cloud events such as suspicious IAM activity or compromised service accounts, not container-level runtime threats within GKE. Option D (Cloud Audit Logs) is wrong because it is a logging service that records API calls and administrative actions, not a detection service; it provides raw data but does not analyze or alert on container threats like privilege escalation.

Practice this question →
35
MCQmedium

A security analyst is investigating a potential compromise of an AWS EC2 instance. Which step should be taken FIRST to contain the incident and prevent further damage?

A.Terminate the EC2 instance immediately.
B.Take a snapshot of the instance for forensic analysis.
C.Isolate the EC2 instance by updating the security group to deny all traffic.
D.Disable the IAM role attached to the instance.
AnswerC

Modifying the security group effectively isolates the instance.

Why this answer

The first priority in incident response is containment. Updating the security group to deny all traffic immediately isolates the EC2 instance from network communication, preventing lateral movement or data exfiltration while preserving the instance for further investigation. This aligns with the NIST SP 800-61 incident response framework, which emphasizes containment before eradication or recovery.

Exam trap

A common misconception is that immediate termination (Option A) is the fastest containment method, but this violates the principle of preserving evidence and may hinder forensic investigation.

How to eliminate wrong answers

Option A is wrong because terminating the instance destroys volatile data (e.g., memory, running processes, network connections) and prevents forensic analysis, which may be critical for understanding the attack vector. Option B is wrong because taking a snapshot is a forensic step that should occur after containment, not before; performing it first could allow the attacker to continue exfiltrating data or spreading to other resources. Option D is wrong because disabling the IAM role does not stop network-level attacks or data exfiltration; the instance could still communicate with external hosts, and the attacker might already have established persistence or backdoor access.

Practice this question →
36
MCQeasy

An organization wants to implement a cloud security automation solution that can automatically remediate non-compliant resources in Azure. Which Azure service should be used to create remediation tasks?

A.Azure Policy
B.Azure Security Center
C.Azure Automation
D.Azure Logic Apps
AnswerA

Azure Policy has built-in remediation tasks for automatic fixes.

Why this answer

Azure Policy includes 'remediation tasks' that can automatically fix non-compliant resources, often using managed identities.

Practice this question →
37
MCQmedium

An organization ingests AWS CloudTrail logs into a centralized SIEM for correlation. They want to detect an attacker who exfiltrates data by downloading large volumes from an S3 bucket. Which SIEM correlation rule would best detect this?

A.Alert on multiple failed login attempts
B.Alert on high volume of GetObject requests from a single IP
C.Alert on root account usage
D.Alert when a new IAM user is created
AnswerB

High volume of downloads from one source is a classic exfiltration indicator.

Why this answer

Exfiltration of data from S3 typically involves a high volume of GetObject API calls from a single source IP. A SIEM correlation rule that triggers on a threshold of GetObject requests from the same IP address directly detects this anomalous download behavior, which is a key indicator of data exfiltration.

Exam trap

This exam often tests the distinction between detection of the exfiltration action itself (high volume of GetObject requests) versus precursor or unrelated events (failed logins, root usage, IAM creation), leading candidates to choose a rule that detects a different phase of the attack chain.

How to eliminate wrong answers

Option A is wrong because multiple failed login attempts indicate a brute-force attack on authentication, not data exfiltration from S3. Option C is wrong because root account usage is a security concern for privilege escalation or configuration changes, but it does not specifically detect bulk data downloads from S3. Option D is wrong because creating a new IAM user is an administrative action that could be part of an attack chain, but it does not directly detect the exfiltration event itself.

Practice this question →
38
MCQmedium

A company uses Azure Policy with remediation tasks to automatically fix non-compliant resources. Which scenario can be automatically remediated using a built-in policy?

A.A virtual machine missing the Log Analytics agent
B.A user creating a new Azure subscription
C.A SQL database with advanced data security disabled
D.A storage account with public network access enabled
AnswerA

Built-in policy can deploy the Log Analytics agent extension automatically.

Why this answer

The built-in Azure Policy 'Deploy Log Analytics agent to Windows VMs' includes a remediation task that automatically installs the Log Analytics agent on existing VMs that are missing it. This is a DeployIfNotExists policy effect, which triggers a remediation task to correct non-compliance without manual intervention.

Exam trap

The CCSP exam often tests the distinction between policy effects (Audit, Deny, DeployIfNotExists) and which ones support automatic remediation, leading candidates to assume any non-compliance can be auto-fixed if a policy exists, but only DeployIfNotExists and Modify effects enable remediation tasks.

How to eliminate wrong answers

Option B is wrong because Azure Policy cannot automatically remediate the creation of a new Azure subscription; subscription creation is a tenant-level action that requires Azure RBAC or Azure Blueprints, not a policy with remediation. Option C is wrong because disabling advanced data security on a SQL database is a configuration that can be audited by Azure Policy, but the built-in policies for SQL advanced data security typically use AuditIfNotExists or Deny effects, not DeployIfNotExists with remediation tasks, so automatic remediation is not available out-of-the-box. Option D is wrong because while Azure Policy can audit or deny storage accounts with public network access enabled, the built-in policies for this setting use Deny or Audit effects, not DeployIfNotExists, meaning they block or report non-compliance but do not automatically remediate existing non-compliant resources.

Practice this question →
39
MCQmedium

A security engineer is investigating a potential data exfiltration incident involving an Amazon S3 bucket. Which set of logs would provide the most relevant information to identify the source IP and API calls made to the bucket?

A.VPC Flow Logs for the subnet where the bucket resides
B.AWS Config configuration history for the S3 bucket
C.AWS CloudTrail data events for the S3 bucket
D.Amazon CloudWatch Logs for the EC2 instance accessing the bucket
AnswerC

CloudTrail data events capture S3 object-level API calls, including source IP and identity.

Why this answer

S3 access logs record details of requests made to an S3 bucket, including the requester's IP and the operation performed. CloudTrail data events also capture S3 API calls at the object level. VPC Flow Logs show network traffic but not API calls.

CloudWatch logs could contain application logs but are not specific to S3 access.

Practice this question →
40
MCQmedium

An organization is setting up a centralized logging solution across multiple accounts in their cloud environment. The security team requires that logs from all accounts be sent to a single security account, with lifecycle policies to transition logs to cheaper storage after 90 days. Which approach should be used?

A.Enable the cloud provider's native audit logging in each account and manually copy logs daily to the security account.
B.Create an audit log configuration in each account and export logs to a centralized monitoring service, then use cross-account log forwarding to a central storage container.
C.Use a serverless function to copy logs from each account's storage container to the central storage container.
D.Use the cloud provider's organizational structure and enable a single audit logging configuration that delivers logs to a central storage container in the management account.
AnswerD

This leverages the organization management service to centrally manage audit trails, simplifying deployment and ensuring all logs are delivered to a single location.

Why this answer

For cross-account log aggregation, the cloud provider's organizational structure can be used to centrally manage audit logging. A single audit logging configuration can be enabled that delivers logs from all accounts to a central storage container in the management account. Lifecycle policies on that container can then manage transitions to lower-cost storage classes after 90 days.

Practice this question →
41
MCQmedium

A security team needs to implement automated remediation for non-compliant resources in a cloud environment. They want to automatically fix public object storage bucket policies. Which combination of services should be used?

A.Audit logging service and serverless compute function
B.Threat detection service and workflow orchestration service
C.Security hub and vulnerability management service
D.Configuration management service and serverless compute function
AnswerD

Correct. Configuration management service evaluates rules and invokes a serverless function to remediate non-compliant resources automatically.

Why this answer

A configuration management service can evaluate resources against compliance rules. When a resource is non-compliant, the service can invoke a serverless compute function to perform automated remediation, such as making a public bucket private.

Exam trap

Candidates may confuse security information and event management (SIEM) or vulnerability scanning tools with remediation capabilities.

Practice this question →
42
Multi-Selectmedium

A security team is enhancing logging in AWS to capture detailed data events for S3 buckets. Which TWO of the following should be enabled to achieve comprehensive monitoring of S3 data access? (Choose two.)

Select 2 answers
A.S3 server access logs
B.AWS CloudTrail data events for S3
C.AWS Config
D.VPC Flow Logs
E.Amazon GuardDuty
AnswersA, B

S3 access logs provide detailed records of requests made to S3.

Why this answer

S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. AWS CloudTrail data events for S3 capture API-level activities such as PutObject, GetObject, and DeleteObject. Together, they offer comprehensive monitoring of S3 data access at both the request level and API activity level.

Exam trap

A common pitfall is confusing AWS Config (which monitors configuration changes) with data access logging capabilities. Candidates often incorrectly select AWS Config for monitoring S3 data access because it records resource configurations, but it does not capture individual data access events. The correct choices for comprehensive data access monitoring are S3 server access logs and CloudTrail data events for S3.

Practice this question →
43
MCQhard

During a security incident, the security team suspects that an attacker has tampered with the cloud audit logs to cover their tracks. Which feature would the team use to verify that the log files have not been modified since they were delivered?

A.Automated anomaly detection for audit logs
B.Log file integrity validation
C.Storage access logs
D.Configuration compliance rules
AnswerB

Log file integrity validation uses hash chains to ensure logs have not been tampered with.

Why this answer

Log file integrity validation uses a cryptographic hash chain to create a digital signature for each log file, which is stored in a separate digest file. By computing the hash of a delivered log file and comparing it to the hash in the digest, the team can detect any tampering or modification after delivery. This feature is specifically designed to verify the integrity and authenticity of cloud audit logs.

Exam trap

ISC2 CCSP exams often test the distinction between features that detect suspicious activity (like CloudTrail Insights) and features that provide cryptographic integrity verification (like log file validation). Candidates may confuse the two and select Insights because it sounds like it would detect tampering.

How to eliminate wrong answers

Option A is wrong because CloudTrail Insights is a feature that detects unusual API activity and potential security threats by analyzing management and data events, but it does not provide any mechanism to verify the integrity or detect tampering of log files after delivery. Option C is wrong because S3 server access logs record requests made to an S3 bucket, not CloudTrail logs, and they do not offer a cryptographic validation mechanism to confirm that CloudTrail log files have not been modified. Option D is wrong because AWS Config rules evaluate resource configurations against desired policies and can detect changes to resources, but they cannot validate the cryptographic integrity of CloudTrail log files or confirm that the logs have not been altered after delivery.

Practice this question →
44
Multi-Selectmedium

A company is using Azure and wants to implement cloud security posture management (CSPM) to detect misconfigurations. Which TWO services can provide CSPM capabilities? (Choose two.)

Select 2 answers
A.Azure Key Vault
B.Azure Policy
C.Azure Monitor
D.Azure Sentinel
E.Microsoft Defender for Cloud
AnswersB, E

Azure Policy can enforce and evaluate compliance with security benchmarks, contributing to CSPM.

Why this answer

Azure Policy is correct because it enforces organizational standards and assesses compliance at scale, providing CSPM capabilities by evaluating Azure resources against defined rules to detect misconfigurations. It integrates with Microsoft Defender for Cloud to offer continuous monitoring and remediation of security posture issues.

Exam trap

The ISC2 CCSP exam often tests the distinction between CSPM (configuration assessment) and SIEM/SOAR (threat detection), so candidates mistakenly choose Azure Sentinel or Azure Monitor because they associate 'security monitoring' with CSPM, but Sentinel focuses on log analysis and incident response, not configuration compliance.

Practice this question →
45
MCQmedium

A cloud security team wants to automatically remediate misconfigured S3 buckets that are publicly accessible. Which combination of AWS services can be used to detect and automatically fix this issue?

A.AWS GuardDuty and AWS Lambda
B.AWS CloudTrail and AWS Lambda
C.AWS Config and AWS Lambda
D.AWS Security Hub and AWS CloudTrail
AnswerC

AWS Config rule triggers a Lambda function to remediate non-compliant S3 buckets.

Why this answer

AWS Config evaluates resource configurations against rules (e.g., 's3-bucket-public-read-prohibited'). When a non-compliant resource is detected, AWS Config can trigger a Lambda function via a custom remediation action to modify the bucket policy. GuardDuty detects threats but does not remediate.

Security Hub aggregates findings but does not automatically fix issues. CloudTrail logs events but does not evaluate configurations.

Practice this question →
46
MCQeasy

A security engineer needs to ensure that all API calls made to cloud resources are logged for auditing. Which cloud auditing feature should be enabled to capture management and data events?

A.Cloud monitoring and logging service
B.Configuration management service
C.Threat detection service
D.Cloud audit logging service
AnswerD

A cloud audit logging service is designed to log API calls and events for auditing, capturing both management and data events.

Why this answer

In cloud environments, an audit logging service is the feature designed to log API calls for auditing. It can capture management events (control plane) and data events (data plane) such as object-level operations and function invocations.

Exam trap

Candidates may confuse monitoring or threat detection services with the dedicated audit logging service. Audit logging specifically captures API calls, which is essential for compliance and forensic analysis.

Practice this question →
47
MCQmedium

A company uses Azure Defender for Cloud to protect its hybrid environment. Which of the following is a feature of Azure Defender that provides vulnerability assessment for virtual machines?

A.Azure Secure Score
B.Azure Policy
C.Defender for Servers
D.Azure Sentinel
AnswerC

Defender for Servers includes vulnerability assessment and threat detection.

Why this answer

Azure Defender includes integrated vulnerability assessment via Qualys or Microsoft built-in scanner, available for Defender for Servers.

Practice this question →
48
Multi-Selectmedium

An organization is implementing a SOAR solution for cloud incident response. Which THREE capabilities are essential for automating incident response workflows? (Choose three.)

Select 3 answers
A.Integration with threat intelligence feeds
B.Automated playbook execution
C.Case management and reporting
D.Manual ticketing system
E.Real-time user activity monitoring
AnswersA, B, C

Enriches alerts with context.

Why this answer

Integration with threat intelligence feeds (A) is essential because SOAR platforms ingest external threat data (e.g., STIX/TAXII feeds, CISA alerts) to enrich alerts and trigger automated responses. This allows the SOAR to correlate cloud events with known indicators of compromise (IOCs) and adjust playbooks dynamically without manual intervention.

Exam trap

ISC2 CCSP often tests the distinction between SOAR's core capabilities (automation, orchestration, and case management) and adjacent technologies like SIEM or UEBA, leading candidates to mistakenly select monitoring or manual processes as essential SOAR features.

Practice this question →
49
Multi-Selectmedium

A company uses GCP and wants to implement agentless vulnerability scanning for their Compute Engine instances. Which TWO services can provide this capability? (Choose two.)

Select 2 answers
A.GCP Web Security Scanner
B.GCP Cloud Armor
C.Rapid7 InsightVM (agentless via API)
D.GCP Security Command Center
E.Qualys Cloud Agent
AnswersC, D

Rapid7 can perform agentless scanning using cloud APIs.

Why this answer

Rapid7 InsightVM can perform agentless vulnerability scanning of GCP Compute Engine instances by leveraging the cloud provider's API to query instance configurations, installed software, and patch levels without requiring an agent on each VM. This is achieved through read-only API integrations that collect system metadata and compare it against vulnerability databases, making it a valid agentless scanning solution for GCP.

Exam trap

The trap here is that candidates often confuse agentless scanning with cloud-native services like Security Command Center (which provides vulnerability findings but relies on agents or API-based scanning partners) or mistakenly think Qualys Cloud Agent can operate agentlessly, when in fact it requires an installed agent.

Practice this question →
50
MCQhard

A cloud security architect is designing a log aggregation strategy for a multi-account AWS environment. The security team needs to ensure logs from all accounts are stored centrally and cannot be altered. Which combination of services meets these requirements?

A.CloudTrail with cross-account log delivery to a central S3 bucket and enable log file validation
B.CloudWatch Logs to a centralized log group with IAM policies
C.S3 server access logs delivered to each account's own bucket
D.VPC Flow Logs to CloudWatch Logs in each account
AnswerA

This provides centralized storage and integrity verification.

Why this answer

AWS CloudTrail supports cross-account log delivery to a central S3 bucket, and enabling log file validation uses a digest file signed with the CloudTrail private key to cryptographically verify that log files have not been modified, deleted, or tampered with since delivery. This combination ensures centralized storage and immutability, meeting the security team's requirements.

Exam trap

The trap here is that candidates may confuse centralized logging (e.g., CloudWatch Logs cross-account) with immutability, overlooking that only CloudTrail's log file validation provides cryptographic proof of non-repudiation and tamper detection.

How to eliminate wrong answers

Option B is wrong because CloudWatch Logs to a centralized log group with IAM policies does not provide cryptographic integrity verification; logs can be altered by anyone with sufficient permissions, and CloudWatch Logs does not offer built-in log file validation like CloudTrail. Option C is wrong because S3 server access logs delivered to each account's own bucket are not centralized; they remain in individual accounts and lack cross-account aggregation, and S3 server access logs do not support log file validation for tamper-proofing. Option D is wrong because VPC Flow Logs to CloudWatch Logs in each account are not stored centrally and have no mechanism to prevent alteration; they are per-account and lack the cryptographic integrity checks required for immutability.

Practice this question →
51
MCQmedium

A cloud security architect is evaluating vulnerability management solutions for a hybrid cloud environment. The team needs to scan both on-premises servers and cloud workloads without installing agents on every system. Which approach is most suitable for cloud workloads?

A.Agent-based scanning using a cloud-native service
B.Network vulnerability scanning from a remote scanner
C.Container image scanning only
D.Agentless scanning via cloud APIs (CSPM)
AnswerD

CSPM tools like AWS Security Hub use API-based scanning to check configurations and vulnerabilities without agents.

Why this answer

Agentless scanning uses cloud APIs to assess vulnerabilities without requiring an agent on each instance. This is ideal for cloud workloads where agents may not be desired.

Practice this question →
52
MCQeasy

An organization wants to detect potential crypto mining activity on their AWS EC2 instances. Which AWS service uses machine learning to identify such threats?

A.AWS WAF
B.Amazon GuardDuty
C.Amazon Inspector
D.AWS Shield
AnswerB

Amazon GuardDuty applies machine learning models to analyse VPC Flow Logs, DNS query logs, and CloudTrail management events for behavioural anomalies indicative of crypto mining, such as sustained outbound connections to known mining pools or unusual CPU utilisation patterns. This satisfies the constraint of detecting crypto mining on EC2 instances without requiring agent installation, as it relies on passive network and account-level telemetry.

Why this answer

Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious activity, including cryptocurrency mining (e.g., connections to known mining pools or unusual compute resource spikes). It analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS logs to identify behavioral patterns indicative of crypto mining, such as sustained outbound traffic to mining pool IPs or unusual EC2 instance launches.

Exam trap

The trap here is that candidates often confuse Amazon Inspector (a vulnerability scanner) with GuardDuty (a threat detection service), mistakenly thinking Inspector's agent-based monitoring can detect runtime threats like crypto mining, when in fact Inspector only assesses configuration and software vulnerabilities.

How to eliminate wrong answers

Option A is wrong because AWS WAF is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting, not a service that uses machine learning to detect crypto mining activity on EC2 instances. Option C is wrong because Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a machine learning-based threat detection service for behavioral anomalies like crypto mining. Option D is wrong because AWS Shield is a managed DDoS protection service that safeguards against distributed denial-of-service attacks, not a service that identifies crypto mining threats via machine learning.

Practice this question →
53
MCQeasy

A security analyst reviews GCP Security Command Center findings and sees a high-severity alert for Event Threat Detection indicating that a service account key was used from an unexpected location. What is the best immediate action to contain the threat?

A.Disable the service account key
B.Create a new service account
C.Delete the service account
D.Rotate the key and monitor
AnswerA

Disabling the key immediately prevents further unauthorized use.

Why this answer

The correct immediate action is to disable the compromised service account key because Event Threat Detection has identified that the key is being used from an unexpected location, indicating potential unauthorized access. Disabling the key stops all further usage without deleting the service account or its other keys, preserving legitimate operations. This aligns with the principle of least privilege and incident response containment, as the key can later be rotated or deleted after investigation.

Exam trap

ISC2 CCSP exams often test the distinction between 'disable' and 'rotate' in key compromise scenarios, where candidates mistakenly choose rotation thinking it invalidates the old key, but rotation only creates a new key without disabling the old one unless explicitly done.

How to eliminate wrong answers

Option B is wrong because creating a new service account does not address the compromised key; the old key remains active and can still be used by the attacker. Option C is wrong because deleting the entire service account would disrupt all applications and resources relying on that account, which is an overly destructive action for a single compromised key. Option D is wrong because rotating the key (generating a new key) does not immediately disable the old compromised key; the old key remains valid until it is explicitly disabled or deleted, allowing continued unauthorized access during the rotation process.

Practice this question →
54
MCQeasy

A company uses Azure Sentinel as its SIEM. To ingest Azure Activity Logs and correlate with other data sources, which connector should be configured?

A.Office 365 connector
B.Azure Defender connector
C.Azure Activity connector
D.Windows Security Events connector
AnswerC

This connector ingests Activity Logs for analysis in Sentinel.

Why this answer

The Azure Activity connector is specifically designed to ingest Azure Activity Logs, which contain subscription-level events such as resource creation, modification, and deletion. This connector enables Sentinel to correlate these operational logs with other data sources for comprehensive threat detection and incident response.

Exam trap

The trap is that candidates may confuse Azure Activity Logs (subscription-level operations) with Azure Defender alerts (security findings) or Office 365 logs (SaaS application logs). However, only the Azure Activity connector ingests subscription-level events needed for correlation with other data sources in Sentinel.

How to eliminate wrong answers

Option A is wrong because the Office 365 connector ingests logs from Microsoft 365 services (e.g., Exchange, SharePoint, Teams), not Azure subscription-level activity logs. Option B is wrong because the Azure Defender connector ingests security alerts from Azure Defender (formerly Azure Security Center), not raw Azure Activity Logs. Option D is wrong because the Windows Security Events connector ingests security event logs from Windows machines (e.g., Event ID 4625 for failed logons), not Azure platform logs.

Practice this question →
55
Multi-Selectmedium

A cloud security analyst is investigating a potential credential compromise in AWS. Which TWO CloudTrail events would be most relevant to establishing a timeline of the compromise?

Select 2 answers
A.DeleteBucket
B.UpdateLoginProfile
C.CreateAccessKey
D.DescribeInstances
E.ConsoleLogin
AnswersC, E

An attacker may create new access keys to maintain persistence.

Why this answer

(CreateAccessKey) is correct because the creation of a new access key pair is a strong indicator of an attacker establishing persistent programmatic access to an AWS account. This event, logged by CloudTrail as 'CreateAccessKey' in the IAM service, provides a precise timestamp for when the attacker may have generated credentials to maintain access outside of the console.

Exam trap

ISC2 often tests the distinction between events that indicate the initial compromise (like credential creation) versus events that are merely post-compromise reconnaissance or data destruction, leading candidates to select DescribeInstances or DeleteBucket as they seem suspicious but are not timeline-establishing events.

Practice this question →
56
MCQmedium

An organization uses GCP and wants to monitor for threats in real-time, including detecting malicious activity from compromised service accounts. Which GCP service should be used?

A.Cloud Audit Logs
B.Cloud Security Scanner
C.Container Threat Detection
D.Event Threat Detection
AnswerD

It detects threats like compromised credentials and suspicious API calls.

Why this answer

Event Threat Detection is part of GCP Security Command Center and provides real-time threat detection for IAM anomalies, including compromised service accounts.

Practice this question →
57
MCQmedium

An organization is using GCP Security Command Center with Event Threat Detection. Which type of event is most likely to generate a finding for 'exfiltration'?

A.A service account creating a new VM
B.A user logging in from a new IP address
C.A firewall rule change allowing all inbound traffic
D.A large number of objects being downloaded from a Cloud Storage bucket
AnswerD

High volume of downloads is a common exfiltration indicator.

Why this answer

Event Threat Detection (ETD) in GCP Security Command Center monitors Cloud Storage access logs for anomalous data access patterns. A large number of object downloads from a single bucket within a short time window is a strong indicator of data exfiltration, as it matches the behavioral signature of bulk data extraction. ETD uses machine learning models trained on normal access baselines to flag such volume-based anomalies as 'exfiltration' findings.

Exam trap

A common trap in the ISC2 CCSP exam is confusing an anomalous sign-in event (Option B) with data exfiltration. Exfiltration requires a data transfer action, such as downloading many objects from a storage bucket, not just authentication from a new location.

How to eliminate wrong answers

Option A is wrong because creating a new VM is an infrastructure provisioning action, not a data movement event; ETD focuses on data access and network anomalies, not resource creation. Option B is wrong because a login from a new IP address typically triggers an 'anomalous login' or 'brute force' finding, not an exfiltration event; exfiltration requires data leaving the environment. Option C is wrong because a firewall rule change allowing all inbound traffic is a misconfiguration finding related to network security, not data exfiltration; ETD would flag this under 'open firewall' or 'ingress' rules, not data theft.

Practice this question →
58
MCQmedium

A SOC analyst notices an alert for 'impossible travel' where a user logged in from New York and then from London within 15 minutes. The SIEM correlation rule likely compares which log fields?

A.User agent and browser type
B.Source IP address and timestamp
C.Destination IP and port
D.Volume of data transferred and timestamp
AnswerB

These are the primary fields used to calculate geographic distance and time difference.

Why this answer

Impossible travel detection typically uses sign-in logs (source IP, geolocation) and event timestamps to identify logins from distant locations within a short time.

Practice this question →
59
MCQeasy

Which of the following is a benefit of enabling log file validation for cloud audit logs?

A.It ensures the integrity of log files by allowing you to confirm that they have not been modified.
B.It automatically deletes old log files based on a retention policy.
C.It encrypts log files at rest.
D.It compresses log files to save storage space.
AnswerA

Log file validation provides integrity verification.

Why this answer

Log file validation uses a hash-based digital signature (such as SHA-256) to create a digest file for each log file. This allows you to verify that the log files have not been tampered with, deleted, or modified after they were delivered, ensuring their integrity for forensic analysis and compliance.

Exam trap

The CCSP exam often tests the distinction between integrity (log file validation) and other security controls like encryption, compression, or lifecycle management, leading candidates to confuse validation with unrelated features.

How to eliminate wrong answers

Option B is wrong because CloudTrail log file validation does not manage retention or deletion; lifecycle policies are configured separately via S3 lifecycle rules or CloudTrail console settings. Option C is wrong because encryption at rest is provided by S3 server-side encryption (SSE-S3, SSE-KMS, or SSE-C), not by log file validation. Option D is wrong because compression is not a feature of log file validation; CloudTrail logs can be delivered in gzip format if configured, but validation does not compress them.

Practice this question →
60
MCQmedium

A security analyst is configuring a SIEM solution and wants to ingest security findings from a cloud provider's security findings service into Splunk. What is the most efficient method?

A.Enable cross-region aggregation of findings, then export to a CSV file.
B.Use a serverless function to pull findings from the findings service API and push to Splunk HTTP Event Collector.
C.Configure the findings service to publish findings to a cloud storage bucket, then use Splunk to read from the bucket.
D.Use a data catalog service to catalog findings data and connect to Splunk via JDBC.
AnswerB

Correct. This method uses a serverless function to directly pull findings from the API and push them to Splunk in near real-time, minimizing latency and operational overhead.

Why this answer

A serverless function can directly invoke the findings service API to retrieve findings and forward them to Splunk's HTTP Event Collector (HEC) in near real-time, avoiding intermediate storage or batch processing. This approach minimizes latency and operational overhead, making it the most efficient method for continuous ingestion.

Exam trap

The trap is that many candidates assume S3-based export (Option C) is the most reliable method, but it introduces latency and requires additional polling, whereas a Lambda push is more efficient for real-time security operations.

How to eliminate wrong answers

Option A is wrong because exporting to a CSV file is a manual, batch-oriented process that lacks automation and real-time capabilities, and cross-Region aggregation alone does not provide a direct ingestion pipeline to Splunk. Option C is wrong because publishing findings to an S3 bucket introduces unnecessary storage and latency, requiring Splunk to poll S3 periodically, which is less efficient than a push-based model. Option D is wrong because AWS Glue is designed for ETL and data cataloging, not for real-time streaming; using JDBC would add complexity and latency, and Security Hub does not expose a JDBC interface.

Practice this question →
61
MCQmedium

A company is implementing a SIEM solution and needs to ingest security logs from multiple AWS accounts into a centralized security account. Which AWS service can best aggregate findings from all accounts?

A.Amazon GuardDuty
B.Amazon CloudWatch Logs
C.AWS Security Hub
D.AWS Config
AnswerC

Security Hub aggregates security findings across accounts and integrates with SIEM.

Why this answer

AWS Security Hub can be enabled in multiple accounts and configured to send findings to a central administrator account, enabling cross-account aggregation.

Practice this question →
62
MCQhard

During a cloud security incident, a security team needs to isolate a compromised virtual machine instance that is performing outbound port scanning. Which containment action should be taken first?

A.Terminate the virtual machine instance immediately
B.Modify the security group to deny outbound traffic
C.Create a snapshot or image of the virtual machine for analysis
D.Detach the virtual machine from the virtual network
AnswerB

Modifying the security group rules quickly stops outbound scanning while preserving the instance for further investigation.

Why this answer

Modifying the virtual machine's security group rules to deny all outbound traffic is a quick and reversible containment action that stops the scanning.

Practice this question →
63
MCQhard

During a forensic investigation of a compromised AWS account, the incident response team needs to determine the exact time an attacker created a new IAM user and what permissions were assigned. Which log source would provide the most reliable evidence?

A.AWS Config configuration history for the IAM user
B.S3 access logs for the bucket containing IAM policy files
C.AWS CloudTrail management events
D.VPC Flow Logs for the management console IP
AnswerC

CloudTrail management events capture all IAM API calls with detailed request parameters.

Why this answer

AWS CloudTrail management events capture all API calls made to the AWS Management Console, SDKs, CLI, and AWS services, including IAM CreateUser and AttachUserPolicy actions. These events record the exact timestamp, source IP, user agent, and the identity of the principal making the call, making them the definitive source for determining when an IAM user was created and what permissions were assigned.

Exam trap

The CCSP exam often tests the distinction between management events (CloudTrail) and data events (S3 access logs, VPC Flow Logs), and the trap here is that candidates confuse network-level logs (VPC Flow Logs) or configuration snapshots (AWS Config) with the API-level audit trail that CloudTrail provides.

How to eliminate wrong answers

Option A is wrong because AWS Config configuration history records the state of resources over time but does not capture the exact API call timestamp or the identity of the caller; it only shows the resulting configuration changes. Option B is wrong because S3 access logs record requests to S3 buckets, not IAM user creation or policy assignment events; they are irrelevant for tracking IAM management actions. Option D is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) but do not log API-level actions like IAM user creation or permission assignments.

Practice this question →
64
MCQhard

A company uses AWS CloudTrail with log file validation enabled. An auditor wants to verify that a specific log file has not been tampered with. Which process should the auditor use to confirm the integrity of the CloudTrail log file?

A.Use the AWS CLI command 'aws cloudtrail validate-logs' which automatically verifies the digital signature and hash
B.Check the log file’s last modified timestamp against the CloudTrail delivery timestamp
C.Compare the log file’s SHA-256 hash with the hash stored in AWS Key Management Service (KMS)
D.Review the log file’s integrity using the SHA-256 checksum provided in the S3 object metadata
AnswerA

The validate-logs command performs the verification using the digest files and public key.

Why this answer

CloudTrail log file validation uses SHA-256 hashing and digital signatures. The log file digest file contains the hash of the log file and is signed by a private key. To verify, the auditor uses the public key (from AWS) to verify the signature on the digest, then compares the hash of the log file to the hash in the digest.

Practice this question →
65
MCQeasy

A cloud security engineer is tasked with ensuring that all API calls made to AWS resources are logged for audit purposes. Which AWS service should be enabled to capture management events such as creating or deleting EC2 instances?

A.AWS Config
B.AWS CloudTrail
C.Amazon GuardDuty
D.AWS Security Hub
AnswerB

CloudTrail records API calls and can be enabled to capture management events.

Why this answer

AWS CloudTrail is the correct service because it is specifically designed to record API activity in an AWS account, including management events such as creating or deleting EC2 instances. It captures the who, what, when, and source IP for every API call, which is essential for audit logging and compliance. AWS Config, by contrast, records resource configuration changes and compliance history, not API call logs.

Exam trap

The trap here is that candidates confuse AWS Config (which tracks configuration history) with CloudTrail (which tracks API calls), leading them to select AWS Config for audit logging of management events.

How to eliminate wrong answers

Option A is wrong because AWS Config records resource configuration changes and evaluates compliance rules, but it does not capture API call logs or management events like creating or deleting EC2 instances. Option C is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC flow logs, DNS logs, and CloudTrail events for malicious activity, but it does not itself generate or store API audit logs. Option D is wrong because AWS Security Hub aggregates security findings from multiple services (including CloudTrail) and provides a compliance dashboard, but it is not a logging service and does not capture raw API events.

Practice this question →
66
MCQmedium

A security analyst notices that an IAM user from a cloud account has logged in from two different countries within a span of 10 minutes. Which type of detection mechanism is most likely to flag this activity as suspicious?

A.A cloud configuration management database (CMDB)
B.A vulnerability scanner
C.An agent-based intrusion detection system (IDS)
D.A correlation rule in a SIEM
AnswerD

SIEM correlation rules can detect impossible travel by analyzing login events.

Why this answer

A correlation rule in a SIEM is designed to aggregate and analyze log data from multiple sources, such as cloud IAM logs, to detect anomalous patterns. The specific scenario of a user logging in from two geographically distant countries within 10 minutes is a classic example of an impossible travel time anomaly, which SIEM correlation rules are built to flag by comparing login timestamps and IP geolocation data.

Exam trap

The CCSP exam often tests the distinction between detection mechanisms that analyze static configurations (CMDB, vulnerability scanners) versus those that analyze dynamic behavioral patterns (SIEM correlation rules), leading candidates to confuse a CMDB's asset inventory function with real-time anomaly detection.

How to eliminate wrong answers

Option A is wrong because a cloud configuration management database (CMDB) is a repository for storing metadata about IT assets and their relationships, not a real-time detection mechanism for user login anomalies. Option B is wrong because a vulnerability scanner is designed to identify security weaknesses in systems (e.g., missing patches, misconfigurations), not to analyze user behavior or login patterns. Option C is wrong because an agent-based intrusion detection system (IDS) monitors network traffic or host-level events for known attack signatures, but it does not typically correlate geolocation data from cloud IAM logs to detect impossible travel scenarios.

Practice this question →
67
Multi-Selecthard

An organization is using GCP and wants to implement automated remediation of security misconfigurations. Which TWO services can be used together to achieve this? (Choose two.)

Select 2 answers
A.Cloud Build
B.Cloud Audit Logs
C.Cloud Storage
D.Cloud Functions
E.Cloud Security Command Center
AnswersD, E

Cloud Functions can execute remediation code when triggered by Security Command Center.

Why this answer

Cloud Functions (D) is correct because it can be triggered by events from Cloud Security Command Center (Cloud SCC) to automatically remediate security misconfigurations. Cloud SCC detects vulnerabilities and misconfigurations, and Cloud Functions can execute remediation logic such as modifying IAM policies, enabling logging, or updating firewall rules. Together, they enable event-driven, automated security response without manual intervention.

Exam trap

The ISC2 CCSP exam often tests the distinction between services that detect or log issues (like Cloud Audit Logs or Cloud SCC alone) versus services that can execute automated remediation (like Cloud Functions), leading candidates to mistakenly select Cloud Audit Logs or Cloud Storage as capable of performing actions.

Practice this question →
68
Multi-Selectmedium

A security architect is designing a logging strategy for a multi-cloud environment using AWS and Azure. Which TWO practices should be implemented to ensure log integrity and prevent tampering? (Choose two.)

Select 2 answers
A.Store logs in a publicly readable S3 bucket for transparency
B.Encrypt logs using server-side encryption with AWS KMS
C.Enable CloudTrail log file validation
D.Use S3 Object Lock or Azure Immutable Blob Storage
E.Enable cross-region replication for logs
AnswersC, D

This uses SHA-256 hashing and RSA signatures to verify log integrity.

Why this answer

Log file validation (e.g., CloudTrail log file validation) ensures cryptographic verification of log integrity. Write-once-read-many (WORM) storage, such as S3 Object Lock or Azure Immutable Blob Storage, prevents deletion or modification of logs.

Practice this question →
69
MCQhard

A security team is investigating a potential credential compromise in a cloud environment. They have cloud audit logs showing a user's access key was used to provision compute instances in a geographic region where the user has never operated. What is the BEST course of action to confirm and contain the incident?

A.Create a new access policy to deny all actions for that user.
B.Check cloud audit logs for the access key events, then rotate the access key.
C.Immediately delete all compute instances launched by that user.
D.Disable the user's console access and delete the access key.
AnswerB

This confirms the usage and revokes the compromised key.

Why this answer

The first step in confirming a potential credential compromise is to verify that the anomalous activity (instance launches in an unfamiliar region) is indeed associated with the specific access key in the audit logs. Once confirmed, rotating the key (i.e., deactivating the old key and issuing a new one) immediately invalidates the compromised credential, stopping any further unauthorized use while preserving the user's ability to operate with a new key. This aligns with cloud security incident response best practices for credential compromise.

Exam trap

ISC2 CCSP often tests the distinction between 'containment' (stopping the attack) and 'remediation' (cleaning up resources); the trap here is that candidates may choose to delete resources (Option C) or disable the user entirely (Option D) instead of focusing on the compromised credential itself, which is the root cause of the incident.

How to eliminate wrong answers

Option A is wrong because creating a new IAM policy to deny all actions for that user is overly broad and may disrupt legitimate operations; it also does not directly invalidate the compromised access key, as the key remains active and could still be used if the policy evaluation allows it (e.g., if the user has other policies granting access). Option C is wrong because immediately deleting all EC2 instances launched by that user destroys forensic evidence and may delete instances that were launched legitimately; containment should focus on the credential, not the resources, until the scope is understood. Option D is wrong because disabling the console password does not affect programmatic access via the access key, and deleting the access key without first confirming it is the compromised key in CloudTrail could delete a legitimate key, causing unnecessary disruption; rotation is the preferred containment action.

Practice this question →
70
Multi-Selectmedium

A company is deploying a SIEM solution in Azure. Which THREE data sources should be ingested to provide comprehensive visibility into the cloud environment?

Select 3 answers
A.Azure Activity Logs
B.Azure Active Directory sign-in logs
C.Azure VNet Flow Logs
D.Azure Monitor Metrics
E.Azure Defender for Cloud alerts
AnswersA, B, E

Azure Activity Logs are correct because they provide the control-plane audit trail for all Azure resource management operations, including create, update, and delete actions. This is essential for detecting unauthorized configuration changes and meeting compliance requirements in a SIEM.

Why this answer

Azure Activity Logs provide a control-plane audit trail for all resource management operations, including create, update, and delete actions, which is essential for detecting unauthorized changes. Azure Active Directory sign-in logs offer identity-level visibility into authentication attempts, helping to identify brute-force or compromised accounts. Azure Defender for Cloud alerts aggregate security findings from various services, highlighting active threats and vulnerabilities.

Azure VNet Flow Logs, while useful for network traffic analysis, are not among the three most critical for comprehensive SIEM visibility; they produce high volume and cost, and are often supplemented by other sources. Azure Monitor Metrics focus on performance data rather than security events, making them less relevant for SIEM.

Exam trap

Candidates often misinterpret the question as requiring network logs (VNet Flow Logs) for completeness, but the three core SIEM sources in Azure are Activity Logs, AD sign‑in logs, and Defender alerts. Flow Logs are valuable but not essential for a basic comprehensive SIEM deployment.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Ccsp Security Ops questions.

Start 20-question session