A cloud-based e-commerce platform needs to audit all data access events. The security team wants to detect fraudulent activities by analyzing user behavior. Which set of event attributes is most useful for this purpose?

Only user identity and timestamp

Only IP address and geolocation

User identity, IP address, geolocation, and timestamp

A security team is defining the attributes to include in data event logs. Which attribute is essential for establishing who performed an action?

Identity of the user or service principal

A company is required to provide audit logs to regulators upon request. The logs must be available within 24 hours and must be tamper-evident. The company uses a cloud logging service that stores logs in a standard bucket. Which configuration best meets these requirements?

Enable object versioning and set a retention policy on the bucket

Store logs in a bucket with public read access

Encrypt logs and store them in a separate bucket

Compress logs and store them in a cold storage tier

A legal team needs to present cloud access logs as evidence in a lawsuit. To ensure the logs are admissible, the security team must demonstrate that the logs have not been altered since collection. Which practice is essential to establish a proper chain of custody?

Document every person who accessed the logs and when

Use cryptographic hashes to verify log integrity at each transfer

Encrypt the logs with the legal team's public key

Store logs in a publicly accessible location

During a forensic investigation, the security team must collect logs from a cloud environment and present them in court. To maintain the chain of custody, which action is most important?

Encrypt the logs with a strong encryption algorithm

Create a cryptographic hash of the logs at collection and at each transfer

Store the logs in a secure location with limited access

Document the collection process and every person who handled the logs

Certified Cloud Security Professional

Domain 2Objective 8

Design and Implement Auditability, Traceability, and Accountability of Data Events CCSP Practice Questions (Page 6)

Part of the Cloud Data Security domain, which accounts for 20% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 2–3 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

20%of the exam

Questions 26–30

26application · medium
A cloud-based e-commerce platform needs to audit all data access events. The security team wants to detect fraudulent activities by analyzing user behavior. Which set of event attributes is most useful for this purpose?
Select an answer first
27foundation · easy
A security team is defining the attributes to include in data event logs. Which attribute is essential for establishing who performed an action?
Select an answer first
28expert · hard
A company is required to provide audit logs to regulators upon request. The logs must be available within 24 hours and must be tamper-evident. The company uses a cloud logging service that stores logs in a standard bucket. Which configuration best meets these requirements?
Select an answer first
29application · medium
A legal team needs to present cloud access logs as evidence in a lawsuit. To ensure the logs are admissible, the security team must demonstrate that the logs have not been altered since collection. Which practice is essential to establish a proper chain of custody?
Select an answer first
30application · medium
During a forensic investigation, the security team must collect logs from a cloud environment and present them in court. To maintain the chain of custody, which action is most important?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.