CCSP - Cloud Platform and Infrastructure Security - Section 3.4

Plan and implementation of security controls.

Physical and environmental protection, system, storage and communication protection, identification, authentication and authorisation in cloud environments, and audit mechanisms such as log collection and correlation.

physical and environmental protectionsystem and communication protectionidentification and authenticationaudit mechanismspacket capture and log correlation

Practice question for this objective

Free sampleCloud Platform and Infrastructure Securitymedium

During an incident review, an analyst needs to reconstruct exactly which bytes crossed a virtual network segment, while a colleague needs to correlate authentication events across many hosts over the same window. Which statement correctly distinguishes the two techniques they are using?

  • APacket capture aggregates event records from multiple sources, while log correlation records full network payloads for deep inspection
  • BPacket capture records full network payloads for deep inspection, while log correlation aggregates event records from multiple sources to reveal patterns Correct
  • CBoth techniques reconstruct full packet payloads, differing only in whether they run in real time or in batch
  • DBoth techniques summarise event metadata, differing only in whether they store data on the host or in the network
Differentiate packet capture from log correlation by the data each works on and the insight each yields. Packet capture retains the full content of traffic so an investigator can inspect payloads byte by byte. Log correlation instead takes many discrete event records from different sources and joins them to expose sequences and relationships that no single log reveals. The two are complementary audit mechanisms, not interchangeable.

Why A is wrong: Tempting because it uses the right vocabulary, but the two definitions are transposed: capture handles payloads and correlation handles aggregated events, not the reverse.

Why B is correct: Correct: packet capture preserves the actual traffic content for byte-level analysis, whereas log correlation joins discrete event records across systems to surface relationships neither log shows alone.

Why C is wrong: Plausible since both aid investigation, but log correlation works on summarised event records rather than raw payloads, so the claim that both reconstruct packets is wrong.

Why D is wrong: Attractive because storage location is a real distinction elsewhere, but packet capture stores full payloads rather than summarised metadata, so this understates what capture provides.

See more CCSP practice questions, answers explained.

More in this domain

Back to all Cloud Platform and Infrastructure Security objectives, or the CCSP cert hub.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.