CCSP - Cloud Platform and Infrastructure Security (17% of the exam) - Section 3.4
Plan and implementation of security controls.
Physical and environmental protection, system, storage and communication protection, identification, authentication and authorisation in cloud environments, and audit mechanisms such as log collection and correlation.
physical and environmental protectionsystem and communication protectionidentification and authenticationaudit mechanismspacket capture and log correlation
Practice question for this objective
lock_openFree sampleCloud Platform and Infrastructure Securitymedium
During an incident review, an analyst needs to reconstruct exactly which bytes crossed a virtual network segment, while a colleague needs to correlate authentication events across many hosts over the same window. Which statement correctly distinguishes the two techniques they are using?
APacket capture aggregates event records from multiple sources, while log correlation records full network payloads for deep inspection
BPacket capture records full network payloads for deep inspection, while log correlation aggregates event records from multiple sources to reveal patternscheck_circle Correct
CBoth techniques reconstruct full packet payloads, differing only in whether they run in real time or in batch
DBoth techniques summarise event metadata, differing only in whether they store data on the host or in the network
Differentiate packet capture from log correlation by the data each works on and the insight each yields. Packet capture retains the full content of traffic so an investigator can inspect payloads byte by byte. Log correlation instead takes many discrete event records from different sources and joins them to expose sequences and relationships that no single log reveals. The two are complementary audit mechanisms, not interchangeable.
Why A is wrong: Tempting because it uses the right vocabulary, but the two definitions are transposed: capture handles payloads and correlation handles aggregated events, not the reverse.
Why B is correct: Correct: packet capture preserves the actual traffic content for byte-level analysis, whereas log correlation joins discrete event records across systems to surface relationships neither log shows alone.
Why C is wrong: Plausible since both aid investigation, but log correlation works on summarised event records rather than raw payloads, so the claim that both reconstruct packets is wrong.
Why D is wrong: Attractive because storage location is a real distinction elsewhere, but packet capture stores full payloads rather than summarised metadata, so this understates what capture provides.
Exam traps in Cloud Platform and Infrastructure Security
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
Authentication, which proves that the presented identity claim is genuine
errorWhy it is wrong: Tempting because authentication is the adjacent step, but authentication verifies a claim rather than establishing the unique label itself, so it comes after identification.
Rely on the private enclave's host-based intrusion detection alerts as the record of interconnect traffic
errorWhy it is wrong: Host IDS alerts describe activity on endpoints and only fire on signatures, so they are neither a complete nor a tamper-evident record of what crossed the interconnect.
Audit and accountability, because the handshake produces a verifiable record of the session
errorWhy it is wrong: Tempting because the handshake can be logged, but the primary function of mutual TLS is protecting the communication, not generating audit records.