CCNA Ccsp Security Ops Questions

Lambda automatically logs to CloudWatch Logs if the function's execution role has permissions. By adding logging statements in the function code, the engineer can log request and response payloads. Setting the CloudWatch Logs retention policy to 90 days meets the retention requirement. This is the standard way to capture detailed invocation logs, including payloads, for Lambda functions.

AWS Config continuously evaluates bucket policies and ACLs against a rule flagging public access, then triggers Lambda for automatic remediation. This satisfies the no-manual-intervention constraint within one account, because Config detects drift and Lambda removes the public grant without human approval.

Log file integrity validation produces cryptographic hashes that let the analyst confirm stored audit logs have not been altered or deleted. It directly satisfies the tamper-detection requirement, unlike versioning or retention locks, which prevent deletion but do not prove integrity.

Google Cloud Armor is a managed web application firewall (WAF) that provides protection against common web vulnerabilities such as SQL injection and cross-site scripting. It integrates with HTTP(S) load balancing and allows you to define security policies with rules to filter traffic. This matches the requirement for a managed service to protect the web application.

Volatile evidence such as memory contents is lost on shutdown or reboot, so capturing a memory dump first preserves critical artifacts like running processes and network connections. Storing it in a write-once location and recording a cryptographic hash establishes integrity and chain of custody, which are essential for forensic validity and later legal or disciplinary use.

Amazon GuardDuty continuously analyses CloudTrail, VPC Flow Logs and DNS logs with managed machine learning and threat intelligence to surface findings including cryptocurrency mining on EC2 instances and compromised IAM credentials. It satisfies the stem's requirement for an AWS-native, ML-driven threat detection service without deploying agents.

Communication with a known cryptocurrency mining pool indicates the instance's compute resources have been hijacked to mine cryptocurrency, typically via malware or a compromised workload. This unauthorised resource consumption is classified as crypto mining on a virtual machine.

GuardDuty continuously analyzes CloudTrail management events, VPC Flow Logs, and DNS logs with machine learning and threat intelligence, producing findings such as anomalous IAM access key usage from unusual geolocations or IP addresses. It requires no custom rule authoring, delivers findings automatically, and integrates with EventBridge for response, making it the lowest-overhead option.

Cloud Audit Logs capture Admin Activity entries recording IAM policy changes and authentication events, with timestamps and actor identities. This gives the forensic analyst the precise chronology of the credential compromise, which other log sources such as VPC Flow Logs or firewall logs cannot provide.

Amazon Inspector's continuous scanning integrates natively with Amazon ECR, automatically re-evaluating repositories when new images are pushed, which satisfies the automation constraint without custom orchestration. Unlike basic ECR scan-on-push, Inspector provides ongoing vulnerability assessment across the repository, detecting newly disclosed CVEs in existing images as well as fresh pushes.

EKS control plane logging can be enabled per log type, including 'audit', directly from the cluster configuration or via the AWS CLI/API. Logs are delivered to CloudWatch Logs, where a retention policy can be set to 90 days. This requires no agents on nodes and is the native, lowest-overhead method for capturing Kubernetes API server audit events.

AWS Systems Manager Run Command executes the dump script remotely through the agent, so no interactive login, SSH session or local tooling alters the instance's volatile state. The memory image is written to an attached EBS volume, preserving evidence integrity for later analysis.

A centralised logging service natively collects and forwards audit trails from cloud resources, providing the direct streaming integration the SIEM consumes. It removes the need for custom agents or polling, satisfying the native-integration constraint in the stem.

Defender for Key Vault monitors Azure Key Vault control-plane and data-plane operations, detecting anomalous access, suspicious secret retrieval and unusual vault activity. It satisfies the stem's requirement for alerts on suspicious Key Vault activity within the hybrid environment, unlike plans scoped to servers, storage or containers.

Changing the password does not revoke existing credentials. An attacker holding active access keys or session tokens continues operating, so this containment step fails. Deactivating the user, deleting access keys and revoking sessions are required to actually cut off access.

Cloud Armor is GCP's web application firewall (WAF) and DDoS protection service. It provides preconfigured WAF rules to mitigate OWASP Top 10 risks like SQL injection and XSS. It integrates with HTTP(S) load balancing, inspecting traffic at the edge, which minimizes latency. It is fully managed, reducing operational overhead.

Agentless scanning queries the cloud provider's APIs to enumerate resources and compare their configurations against vulnerability and patch baselines, so no software is installed on the guest OS. This directly satisfies the stem's constraint of identifying vulnerabilities without deploying agents.

Immutable blob storage with a time-based retention policy written in legal-hold or locked policy mode prevents modification or deletion of blobs for the specified interval, and the policy can be set to seven years. Diagnostic settings can export activity logs to the storage account, meeting the immutability and retrievability requirements.

Cloud Audit Logs capture administrative actions against the cluster and its resources, recording the calling identity, the API method, and the timestamp. Enabling Admin Activity and Data Access audit logs provides the attribution the team needs to trace any administrative action to a named principal.

VPC Flow Logs capture IP-level metadata for traffic traversing elastic network interfaces, including source and destination addresses, ports, protocol and bytes transferred. This directly satisfies the requirement to identify exfiltration destinations and quantify transferred volume, which CloudTrail management events cannot provide.

The Azure Monitor activity log captures subscription-level control plane operations, including resource group deletions. Exporting to a storage account with immutable blob storage (using time-based retention policies) ensures logs cannot be altered or deleted for the specified period. Azure Monitor alerts can trigger on specific events from the activity log, such as Delete Resource Group, providing real-time notification.

CloudTrail records API activity across regions. Delivering to an S3 bucket with versioning and MFA delete prevents accidental or malicious deletion. A bucket policy explicitly denying s3:DeleteObject for all principals, including administrators, enforces immutability. This combination meets retention and forensic search needs, as logs are stored durably and accessible via Athena or CloudTrail Lake.

CloudWatch Logs cross-account subscription filters stream log events in near real time from source accounts to a Kinesis Data Streams or Lambda destination in the security account, satisfying the centralised aggregation requirement without polling. This native mechanism avoids duplicating log groups per account, unlike resource-policy-based sharing.

Amazon Inspector continuously scans EC2 instances using the Systems Manager agent to detect software vulnerabilities and unintended network exposure, then assigns severity ratings and aggregates findings centrally across accounts via AWS Organizations and delegated administrator. This directly matches the requirement for ongoing OS patch and misconfiguration assessment with consolidated findings and remediation guidance.

The Azure Activity Log records subscription-level control-plane operations including role assignment and policy changes, with the caller identity and timestamp. Routing it through a diagnostic setting to a Log Analytics workspace enables long-term retention and querying, satisfying the 90-day review and compliance retention needs.

AWS Systems Manager Run Command executes a memory acquisition script directly on the running EC2 instance, preserving volatile memory contents. This avoids rebooting or stopping the instance, which would destroy the RAM evidence needed for forensic analysis.

SOAR platforms integrate security tools and execute predefined playbooks automatically, triggering containment, enrichment and notification actions when alerts fire. This orchestration and automation directly satisfies the stem's requirement to accelerate incident response beyond manual analyst triage.

Cloud storage access logs capture per-request records for object operations, including the GET method, requester identity, source IP address and timestamp. This granular detail satisfies the requirement to identify who downloaded the data and from where during the exfiltration investigation.

AWS Security Hub aggregates findings across accounts and Regions via a single pane, then forwards them to third-party SIEMs such as Splunk through native integrations or EventBridge. This satisfies the requirement to centralise findings from multiple AWS accounts before onward delivery.

Node affinity rules in the pod spec use node labels as match expressions, so only nodes carrying the required hardened baseline label will be eligible. This directly enforces the placement requirement on GKE without needing a custom scheduler, and it can be made mandatory with requiredDuringSchedulingIgnoredDuringExecution.

CSPM continuously assesses cloud resource configurations against benchmarks such as CIS and identifies misconfigurations, drift and compliance gaps. This directly satisfies the stem's focus on the primary purpose: evaluating and hardening the security posture of provisioned cloud resources, rather than runtime workload protection or identity governance.

AWS CloudTrail records API activity in an AWS account, including actions taken by users, roles, and AWS services. It provides event history and can deliver logs to an S3 bucket, which can be configured with Object Lock for immutability. This meets the requirement to capture all API activity and retain logs immutably for 7 years.

Cloud Audit Logs captures Admin Activity and Data Access entries for every API call in the project, satisfying the requirement to record all API activity. Enabling it at project level provides the audit trail directly, unlike Cloud Logging, which aggregates logs but does not itself generate API audit records.

A CSPM tool continuously assesses cloud resources against benchmarks such as CIS, aggregating findings into a unified compliance dashboard with prioritised remediation recommendations. This directly satisfies the stem's requirement for a single view of compliance posture, unlike native logging or inventory services that report raw configuration data without benchmark mapping.

A serverless orchestration service, such as AWS Step Functions, sequences incident response steps, branching and retrying between Lambda invocations. It satisfies the serverless orchestration workflow requirement by coordinating state across tasks without provisioning servers, complementing the serverless compute service chosen alongside it.

Container Threat Detection continuously monitors Kubernetes Engine runtime activity, flagging privilege escalation, suspicious binaries and reverse shells inside containers. It operates at the workload level rather than scanning images or network flows, directly matching the requirement to detect in-cluster container threats.

Replacing the instance's security group with one denying all inbound and outbound traffic cuts attacker access instantly while leaving the instance running. Memory, processes and disk state remain intact for forensic capture, unlike termination or reboot, which would destroy volatile evidence.

Azure Policy evaluates resources against built-in or custom definitions and, through remediation tasks, automatically corrects non-compliant resources using managed identities. This directly satisfies the requirement for automated remediation in Azure, unlike monitoring or advisory services that only detect and report drift without enforcing configuration changes.

GetObject requests represent actual object downloads, so alerting when a single IP generates an abnormally high volume of them detects bulk data retrieval. Aggregating by source IP over a time window satisfies the exfiltration scenario, distinguishing sustained mass downloading from routine sporadic access.

The built-in Deploy Log Analytics agent policy uses the deployIfNotExists effect, so a remediation task installs the missing extension on virtual machines flagged as non-compliant. This directly satisfies the automatic remediation scenario for VMs lacking the Log Analytics agent.

CloudTrail data events record object-level S3 API activity, capturing the caller's source IP and the specific operations performed on the bucket. Management events alone omit object-level calls, so data events are required to trace the exfiltration's origin and API sequence.

Container Threat Detection is a built-in service in GKE that monitors container runtime activity. It detects threats like cryptomining, reverse shells, and malware execution by analyzing system calls and process behavior. It provides detailed container-level visibility and integrates natively with GKE, sending findings to Security Command Center. This meets the requirement for runtime threat detection.

S3 Object Lock in compliance mode prevents object versions from being overwritten or deleted for the specified retention period. Critically, compliance mode cannot be bypassed or shortened by any user, including the AWS account root user, satisfying the auditor's immutability requirement. Governance mode, by contrast, allows privileged users to alter retention.

Microsoft Defender for Cloud's just-in-time VM access allows you to lock down inbound traffic to VMs, permitting access only when needed and for a specified duration. It integrates with Azure RBAC and network security groups to grant temporary access on management ports, reducing exposure to attacks.

A configuration management service continuously evaluates resource configuration against policy and detects non-compliant public bucket policies, then invokes a serverless function to remediate them automatically. This pairing satisfies the requirement for automated, event-driven correction without manual intervention.

S3 server access logs record every request made to a bucket, including the requester, action, timestamp and response code, giving object-level audit detail. They capture data-plane access that bucket-level logging misses, satisfying the requirement for comprehensive S3 data access monitoring.

AWS Config records changes to resource configurations, including security groups. You can create a custom rule or use a managed rule to evaluate security group configurations and trigger an alert when a rule allows inbound SSH from 0.0.0.0/0. AWS Config can also send notifications via Amazon SNS, enabling the security team to respond promptly.

This approach uses Patch Manager's core components: a patch baseline defines approved patches, a patch group links instances to the baseline, and a maintenance window schedules the patching during a defined period. It automates patching, reduces manual effort, and can be configured to patch one instance at a time or in batches, preserving availability.

Security Hub publishes findings to EventBridge as events. You can create an EventBridge rule that matches critical findings and targets an AWS Lambda function or directly an API destination. EventBridge supports API destinations, allowing you to invoke external REST APIs. This enables automatic ticket creation in the ITSM system when a critical finding occurs.

Modifying the security group to allow only forensic subnet traffic effectively isolates the instance while permitting necessary forensic access. This is a common isolation technique that blocks all other inbound and outbound traffic, aligning with the requirement to block all network traffic except forensic analysis traffic.

This is correct because referencing the load balancer's security group as the source in the instance security group ensures only traffic from the load balancer is allowed, and removing other rules eliminates internet SSH. It uses security group referencing, which is the AWS-recommended least-privilege approach and requires no changes to the load balancer or instances.

AWS Config rules continuously evaluate bucket policies and ACLs, flagging public access as non-compliant. The configuration change then triggers a Lambda function that programmatically removes the public permissions, delivering automated detection and remediation without manual intervention.

Admission controllers can block new pods that reference a denied image, while a rolling update triggered by changing the image tag replaces existing pods with the patched version. This combination prevents vulnerable images from being scheduled and ensures running workloads converge on the safe image without manual pod deletion, directly satisfying the automatic replacement requirement.

A cloud audit logging service records API activity, capturing both management events (control-plane operations) and data events (object-level reads and writes) with caller identity, timestamp and source IP. Enabling it satisfies the requirement to log all API calls for auditing.

Defender for Servers includes Microsoft Defender for Endpoint integration, delivering agent-based vulnerability assessment for Azure, AWS, GCP and on-premises VMs. This satisfies the stem's hybrid-environment constraint, since the same scanning capability extends beyond Azure to non-Azure machines, unlike agentless scanning limited to Azure and AWS resource types.

Azure Policy's deployIfNotExists effect assigns Diagnostic Settings at scale, streaming each subscription's Activity Log to one central Log Analytics workspace. This satisfies the cross-subscription collection and retention requirement without per-subscription manual configuration, since policy remediation enrols new subscriptions automatically.

Agentless scanning via cloud APIs queries the provider's control plane, so no software runs on each workload. This satisfies the stem's constraint of scanning cloud workloads without installing agents, unlike host-based tools that require per-system deployment.

Amazon GuardDuty applies machine learning models to analyse VPC Flow Logs, DNS query logs, and CloudTrail management events for behavioural anomalies indicative of crypto mining, such as sustained outbound connections to known mining pools or unusual CPU utilisation patterns. This satisfies the constraint of detecting crypto mining on EC2 instances without requiring agent installation, as it relies on passive network and account-level telemetry.

Disabling the compromised service account key immediately invalidates the credential, halting any further authenticated API calls from the unexpected location. This directly satisfies the containment requirement, since the key itself is the abused authentication artefact and revocation stops the threat without deleting the account's audit history.

An EBS snapshot captures the block-level state of the attached volumes, preserving disk-based artifacts such as logs, binaries, and configuration. Taking it before remediation ensures the evidence remains intact even if the instance is later terminated or modified, which is essential for forensic analysis and legal defensibility.

The Azure Activity connector streams subscription-level control-plane events, such as resource creation and role assignments, into the Microsoft Sentinel workspace. It satisfies the stem's requirement to ingest Azure Activity Logs and correlate them with other sources through analytics rules and workbooks.

The Azure Activity Log provides a history of subscription-level events, including role assignments and resource changes. It retains data for 90 days by default, which aligns with the analyst's requirement. By reviewing the Activity Log, the analyst can see who made changes, what resources were affected, and when the changes occurred, which is essential for incident investigation.

Event Threat Detection continuously analyses Cloud Audit Logs and VPC flow logs using threat intelligence to surface compromised service accounts, cryptomining and data exfiltration in near real-time. Security Command Center Premium surfaces these findings, satisfying the real-time monitoring requirement that Cloud Logging alone cannot provide.

Event Threat Detection flags exfiltration when an unusually large volume of objects is downloaded from a Cloud Storage bucket, indicating bulk data theft. This behaviour matches the exfiltration detector's data-egress heuristics rather than IAM or network findings.

Impossible travel detection calculates the geographic distance between successive authentications and divides it by elapsed time. The SIEM rule therefore correlates source IP address, which resolves to location, against the timestamp of each login event to derive an impossible velocity.

Log file validation uses cryptographic hashing to produce a digest for each audit log file, letting you verify that entries have not been altered or deleted after capture. This directly satisfies the stem's integrity requirement, supporting tamper-evident audit trails for compliance and forensic investigations.

AWS Security Hub aggregates findings across accounts through its multi-account administration, letting a delegated security account receive and consolidate findings from every member account. This directly satisfies the requirement to centralise findings from multiple AWS accounts into one security account, unlike services scoped to a single account.

AWS Config continuously records resource configurations and evaluates them against rules. Conformance packs bundle AWS Config rules mapped to standards such as the CIS AWS Foundations Benchmark and can be deployed across an organization using a delegated administrator account. This provides the continuous compliance evaluation and drift detection the team requires across all accounts.

CloudTrail records API activity across AWS services, capturing management events such as RunInstances or TerminateInstances with caller identity, source IP and timestamp. Enabling it in each region and account provides the audit trail the stem requires, which service-level logs alone cannot deliver.

A SIEM correlation rule joins disparate events across a time window, so it can compare two authentication logs from different countries ten minutes apart and raise an alert. Single-event detections, such as signature or anomaly checks, evaluate each login in isolation and miss the geographic impossibility.

S3 Object Lock in compliance mode prevents any user, including the root account, from overwriting or deleting a protected object version until the retention date passes. This is the strongest native immutability control in S3 and directly satisfies the seven-year retention requirement for regulated data.

CloudTrail log file validation generates digest files containing hashes of each delivered log, enabling detection of any post-delivery alteration or deletion. This satisfies the log-integrity requirement by cryptographically proving AWS API activity records were not tampered with before forensic review.

Cloud audit logs record every API call made with the compromised access key, including timestamps, source IPs and requested actions. This chronological record directly establishes when the key was first misused and the sequence of attacker activity, satisfying the need to determine the compromise timeline.

An organization trail automatically applies to all accounts in AWS Organizations, delivering a single consolidated record of API activity. Delivering to a centralized S3 bucket protected by S3 Object Lock in compliance mode prevents deletion or alteration, and CloudTrail log file integrity validation provides cryptographic proof that logs were not tampered with, satisfying forensic-grade requirements.

AWS CloudTrail captures API activity across AWS resources, covering both management events and, when configured, data events such as S3 object operations. Its log file validation feature produces digest files proving logs were not altered after delivery, satisfying the auditing and tamper-evidence requirements stated in the stem.