A security analyst is reviewing logs and notices a large number of failed login attempts from a single IP address. The analyst wants to determine if this is a brute-force attack. Which log analysis technique is most effective?

Check the user's password policy

Review the application's source code

Disable the user accounts involved

Aggregate failed login events by source IP and time window

Which principle is fundamental to maintaining chain of custody for data event logs?

Making logs available to all employees

Encrypting logs with the data owner's public key

Storing logs in the same location as the original data

Documenting every person who handles the logs and when

A cloud service provider must ensure that audit logs cannot be altered by administrators who have access to the log storage. Which mechanism best achieves log integrity?

Compress logs to reduce storage size

Store logs in a separate account with restricted access

Use write-once-read-many (WORM) storage for logs

What is the primary purpose of maintaining a chain of custody for data event logs?

To reduce the storage cost of logs

To simplify the log retention policy

To ensure the logs are admissible as evidence in legal proceedings

To improve the performance of log analysis

A cloud security analyst is cataloging the potential sources of data events that must be monitored for auditability. Which of the following is an example of a data event source in a cloud environment?

A database management system recording a SELECT query executed by an application user

A hypervisor scheduling a virtual machine on a physical host

A load balancer distributing HTTP requests to backend servers

A network firewall dropping a packet based on a security rule

Certified Cloud Security Professional

Domain 2Objective 8

Design and Implement Auditability, Traceability, and Accountability of Data Events CCSP Practice Questions (Page 2)

Part of the Cloud Data Security domain, which accounts for 20% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 2–3 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

20%of the exam

Questions 6–10

6application · medium
A security analyst is reviewing logs and notices a large number of failed login attempts from a single IP address. The analyst wants to determine if this is a brute-force attack. Which log analysis technique is most effective?
Select an answer first
7foundation · easy
Which principle is fundamental to maintaining chain of custody for data event logs?
Select an answer first
8application · medium
A cloud service provider must ensure that audit logs cannot be altered by administrators who have access to the log storage. Which mechanism best achieves log integrity?
Select an answer first
9foundation · easy
What is the primary purpose of maintaining a chain of custody for data event logs?
Select an answer first
10foundation · easy
A cloud security analyst is cataloging the potential sources of data events that must be monitored for auditability. Which of the following is an example of a data event source in a cloud environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.