A security team needs to ensure that audit logs are not tampered with after they are generated. They are considering various logging mechanisms. Which mechanism provides the strongest assurance of log integrity?

Append-only logging with cryptographic signing

Storing logs in a database with access controls

Encrypting logs with a strong encryption algorithm

Regularly backing up logs to another region

A company's security team is investigating a data breach. They need to identify all sources of data events that could provide evidence of unauthorized access. Which approach best ensures comprehensive event source identification?

Use a single SIEM tool to collect logs from all sources

Inventory all cloud services and enable logging for each one

Enable logging only for critical applications

A security analyst is reviewing logs from a cloud application and notices that a user accessed a sensitive database at 3:00 AM from an IP address that is not associated with the user's typical location. The analyst wants to determine if this is a potential security incident. Which log analysis technique is most appropriate?

Ignore the event because it is a single occurrence

Check the user's password strength

Correlate the event with other user activity and access patterns

Immediately block the user's account

A forensic investigator needs to collect logs from a cloud environment that has multiple administrators. The investigator is concerned that an administrator might have tampered with the logs. Which action best preserves the chain of custody?

Use a write-once-read-many (WORM) storage for the collected logs

Encrypt the logs with a key held by the investigator

Store the logs in a location accessible to all administrators

Ask the administrators to confirm the logs are unchanged

A company must retain audit logs for at least seven years to meet regulatory requirements. Which storage strategy best supports this requirement while maintaining log integrity?

Store logs in an immutable, write-once-read-many (WORM) storage solution

Store logs in a database table that allows updates and deletes

Store logs on the local disk of the application server

Store logs in a standard cloud storage bucket with default permissions

Certified Cloud Security Professional

Domain 2Objective 8

Design and Implement Auditability, Traceability, and Accountability of Data Events CCSP Practice Questions (Page 4)

Part of the Cloud Data Security domain, which accounts for 20% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 2–3 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

20%of the exam

Questions 16–20

16application · medium
A security team needs to ensure that audit logs are not tampered with after they are generated. They are considering various logging mechanisms. Which mechanism provides the strongest assurance of log integrity?
Select an answer first
17application · medium
A company's security team is investigating a data breach. They need to identify all sources of data events that could provide evidence of unauthorized access. Which approach best ensures comprehensive event source identification?
Select an answer first
18application · medium
A security analyst is reviewing logs from a cloud application and notices that a user accessed a sensitive database at 3:00 AM from an IP address that is not associated with the user's typical location. The analyst wants to determine if this is a potential security incident. Which log analysis technique is most appropriate?
Select an answer first
19expert · hard
A forensic investigator needs to collect logs from a cloud environment that has multiple administrators. The investigator is concerned that an administrator might have tampered with the logs. Which action best preserves the chain of custody?
Select an answer first
20foundation · easy
A company must retain audit logs for at least seven years to meet regulatory requirements. Which storage strategy best supports this requirement while maintaining log integrity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.