CCSP Cloud Security Operations

Question 1

What is the primary goal of a Security Information and Event Management (SIEM) system in cloud operations?

Accepted Answer

To aggregate, correlate, and analyze security events from multiple sources for threat detection and incident response

Answer

To encrypt all log data at rest

Answer

To block malicious traffic at the network perimeter

Answer

To manage user identity and access

Question 2

In cloud incident response, what does the containment phase primarily involve?

Accepted Answer

Limiting the spread and impact of the incident to prevent further damage

Answer

Identifying the root cause of the incident

Answer

Restoring systems to normal operation

Answer

Documenting lessons learned

Question 3

What does cloud log management best practice require regarding log integrity?

Accepted Answer

Logs should be written to a separate, immutable, write-once storage location to prevent tampering

Answer

Logs should be deleted after 30 days to save storage

Answer

Logs should be stored in the same account as the resources they monitor

Answer

Logs should be compressed to reduce size and stored locally on each VM

Question 4

What is the purpose of a runbook in cloud security operations?

Accepted Answer

A documented, step-by-step procedure for responding to specific security incidents or operational tasks

Answer

A physical binder containing server hardware specs

Answer

A log of all software deployments

Answer

A compliance checklist for cloud audits

Question 5

Which metric measures the average time from when an attack occurs to when it is detected?

Accepted Answer

Mean Time to Detect (MTTD)

Answer

Mean Time to Repair (MTTR)

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Question 6

What is the key difference between vulnerability scanning and penetration testing?

Accepted Answer

Vulnerability scanning identifies potential weaknesses automatically; penetration testing actively exploits vulnerabilities to determine real impact

Answer

Vulnerability scanning is illegal; penetration testing is not

Answer

Penetration testing is automated; vulnerability scanning is manual

Answer

Vulnerability scanning requires physical access; penetration testing is remote only