CCSP Cloud Security Operations 1 — Questions and Answers
Question 1: What is the primary goal of a Security Information and Event Management (SIEM) system in cloud operations?
- To encrypt all log data at rest
- To aggregate, correlate, and analyze security events from multiple sources for threat detection and incident response (Correct answer)
- To block malicious traffic at the network perimeter
- To manage user identity and access
Correct answer: To aggregate, correlate, and analyze security events from multiple sources for threat detection and incident response
A SIEM centralizes log collection and applies correlation rules to detect suspicious patterns across an organization's entire cloud and on-premises environment.
Question 2: In cloud incident response, what does the containment phase primarily involve?
- Identifying the root cause of the incident
- Limiting the spread and impact of the incident to prevent further damage (Correct answer)
- Restoring systems to normal operation
- Documenting lessons learned
Correct answer: Limiting the spread and impact of the incident to prevent further damage
Containment stops the attack from spreading by isolating affected systems, revoking compromised credentials, and blocking malicious traffic.
Question 3: What does cloud log management best practice require regarding log integrity?
- Logs should be deleted after 30 days to save storage
- Logs should be written to a separate, immutable, write-once storage location to prevent tampering (Correct answer)
- Logs should be stored in the same account as the resources they monitor
- Logs should be compressed to reduce size and stored locally on each VM
Correct answer: Logs should be written to a separate, immutable, write-once storage location to prevent tampering
Logs must be stored in a separate, write-once (immutable) location outside the monitored environment to prevent attackers from covering their tracks by modifying or deleting logs.
Question 4: What is the purpose of a runbook in cloud security operations?
- A physical binder containing server hardware specs
- A documented, step-by-step procedure for responding to specific security incidents or operational tasks (Correct answer)
- A log of all software deployments
- A compliance checklist for cloud audits
Correct answer: A documented, step-by-step procedure for responding to specific security incidents or operational tasks
Runbooks provide standardized, repeatable procedures that operations teams follow during incidents, reducing response time and human error.
Question 5: Which metric measures the average time from when an attack occurs to when it is detected?
- Mean Time to Repair (MTTR)
- Mean Time to Detect (MTTD) (Correct answer)
- Recovery Point Objective (RPO)
- Recovery Time Objective (RTO)
Correct answer: Mean Time to Detect (MTTD)
Mean Time to Detect (MTTD) measures the average elapsed time between the start of an attack and its detection by the security team.
Question 6: What is the key difference between vulnerability scanning and penetration testing?
- Vulnerability scanning is illegal; penetration testing is not
- Vulnerability scanning identifies potential weaknesses automatically; penetration testing actively exploits vulnerabilities to determine real impact (Correct answer)
- Penetration testing is automated; vulnerability scanning is manual
- Vulnerability scanning requires physical access; penetration testing is remote only
Correct answer: Vulnerability scanning identifies potential weaknesses automatically; penetration testing actively exploits vulnerabilities to determine real impact
Vulnerability scanners produce lists of potential issues without confirming exploitability, while penetration testers actively attempt to exploit vulnerabilities to assess real-world risk.
CCSP Cloud Security Operations 1
What is the primary goal of a Security Information and Event Management (SIEM) system in cloud operations?