hardMultiple ChoiceObjective-mapped
CCSP Practice Question: Which type of threat is this log most likely…
Exhibit
Refer to the exhibit. The following is a log entry from a cloud access security broker (CASB): Event: Anomalous data transfer User: user@example.com Application: Salesforce Data size: 2.5 GB Time: 02:00 AM Location: IP 203.0.113.45 (country: Unknown) Action: Allow (policy exception)
Which type of threat is this log most likely indicating?
⚠ Common exam trap
ISC2 often tests the distinction between data exfiltration and insider threat by presenting a log of outbound data transfer without user context, leading candidates to incorrectly assume insider intent when the pattern itself defines the threat type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data exfiltration
The log shows a large volume of outbound data transfers from a cloud storage bucket to an external IP address, which is characteristic of data exfiltration. In cloud environments, such activity often involves unauthorized copying of sensitive data to an attacker-controlled location, bypassing normal access controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Account takeover
Why it's wrong here
Account takeover would typically involve unusual logins or credential changes, not just data transfer.
- ✗
Malware infection
Why it's wrong here
Malware often causes data transfer but would also show other signs like performance issues or file changes.
- ✗
Insider threat
Why it's wrong here
While an insider could exfiltrate data, the log directly points to data transfer activity, making exfiltration more specific.
- ✓
Data exfiltration
Why this is correct
Anomalous large data transfer to an unknown location at unusual time is a classic sign of data exfiltration.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.