CCSP Cloud Security Operations

Question 1

What is the primary goal of a Security Information and Event Management (SIEM) system in cloud operations?

Accepted Answer

To aggregate, correlate, and analyze security events from multiple sources for threat detection and incident response

Answer

A SIEM centralizes log collection and applies correlation rules to detect suspicious patterns across an organization's entire cloud and on-premises environment.

Question 2

In cloud incident response, what does the containment phase primarily involve?

Accepted Answer

Limiting the spread and impact of the incident to prevent further damage

Answer

Containment stops the attack from spreading by isolating affected systems, revoking compromised credentials, and blocking malicious traffic.

Question 3

What does cloud log management best practice require regarding log integrity?

Accepted Answer

Logs should be written to a separate, immutable, write-once storage location to prevent tampering

Answer

Logs must be stored in a separate, write-once (immutable) location outside the monitored environment to prevent attackers from covering their tracks by modifying or deleting logs.

Question 4

What is the purpose of a runbook in cloud security operations?

Accepted Answer

A documented, step-by-step procedure for responding to specific security incidents or operational tasks

Answer

Runbooks provide standardized, repeatable procedures that operations teams follow during incidents, reducing response time and human error.

Question 5

Which metric measures the average time from when an attack occurs to when it is detected?

Accepted Answer

Mean Time to Detect (MTTD)

Answer

Mean Time to Detect (MTTD) measures the average elapsed time between the start of an attack and its detection by the security team.

CCSP - Certified Cloud Security Professional Exam Practice Test

CCSP - Certified Cloud Security Professional Exam Practice Test

CCSP Cloud Security Operations