CCSP Cloud Security Operations 2 — Questions and Answers
Question 1: What is the primary purpose of a cloud Security Operations Center (SOC)?
- To develop new cloud applications
- To continuously monitor, detect, analyze, and respond to cybersecurity incidents in the cloud environment (Correct answer)
- To manage cloud billing and cost optimization
- To perform software deployments
Correct answer: To continuously monitor, detect, analyze, and respond to cybersecurity incidents in the cloud environment
A SOC is a centralized function staffed with security analysts who monitor the organization's cloud environment 24/7 to detect and respond to threats.
Question 2: Which concept describes the minimum level of access rights a user or system should be granted to perform their required functions?
- Defense in depth
- Principle of least privilege (Correct answer)
- Separation of duties
- Need to know
Correct answer: Principle of least privilege
The principle of least privilege limits access rights to only what is necessary for the user's role, minimizing the potential damage from accidents or compromised credentials.
Question 3: In cloud forensics, why is evidence collection challenging compared to traditional on-premises forensics?
- Cloud environments have no logging capabilities
- Evidence may be distributed across multiple jurisdictions, shared infrastructure makes isolation difficult, and data may be volatile or ephemeral (Correct answer)
- Cloud providers do not allow forensic access
- Cloud forensics only applies to IaaS
Correct answer: Evidence may be distributed across multiple jurisdictions, shared infrastructure makes isolation difficult, and data may be volatile or ephemeral
Cloud forensics is complicated by data being spread across multiple countries, shared hardware making chain of custody complex, and auto-scaling that may destroy evidence by terminating instances.
Question 4: What is the purpose of chaos engineering in cloud security operations?
- To intentionally introduce failures to test system resilience and identify weaknesses before real incidents occur (Correct answer)
- To randomly delete cloud resources for cost savings
- To create disorganized development processes
- To test employee reactions to ransomware
Correct answer: To intentionally introduce failures to test system resilience and identify weaknesses before real incidents occur
Chaos engineering deliberately injects failures (e.g., terminating instances, dropping network packets) to validate that security and resilience controls work as expected under real failure conditions.
Question 5: What is the difference between an RTO and an RPO in cloud disaster recovery planning?
- RTO measures data loss; RPO measures downtime
- RTO is the maximum acceptable downtime; RPO is the maximum acceptable data loss measured in time (Correct answer)
- Both measure the same metric from different perspectives
- RTO applies to databases; RPO applies to applications
Correct answer: RTO is the maximum acceptable downtime; RPO is the maximum acceptable data loss measured in time
RTO (Recovery Time Objective) defines how long the system can be down, while RPO (Recovery Point Objective) defines how much data loss (measured in time) is acceptable.
Question 6: Which cloud security practice involves regularly reviewing and removing unused IAM accounts, roles, and permissions?
- Threat intelligence integration
- Access entitlement review (access recertification) (Correct answer)
- Penetration testing
- Security awareness training
Correct answer: Access entitlement review (access recertification)
Access entitlement reviews (also called access recertification or user access reviews) periodically verify that all IAM grants are still needed and remove those that are not.
CCSP Cloud Security Operations 2
What is the primary purpose of a cloud Security Operations Center (SOC)?