A security analyst notices a spike in failed login attempts to a cloud application, followed by a successful login from an unusual location, and then a large download from a database. Which type of correlation would most effectively identify this as a potential attack?

Correlating the successful login location with a list of known malicious IP addresses.

Correlating authentication logs with database access logs and network logs to identify a sequence of events.

Correlating the database download size with historical usage patterns.

Correlating only the failed login attempts to determine if they exceed a threshold.

During an incident investigation, an analyst needs to reconstruct the exact sequence of actions taken by an attacker in a cloud environment. The attacker is known to have used the AWS CLI. Which log source would provide the most detailed and authoritative timeline of the attacker's API calls?

AWS Config configuration history.

AWS CloudTrail management events.

CloudWatch application logs from the EC2 instances.

A security team is selecting a centralized log management tool. They have a small team with limited security expertise and need to quickly identify common attacks. They also want to retain the ability to create custom detection rules later. Which tool capability is most important?

A highly customizable rule engine that requires extensive scripting to set up.

Pre-built correlation rules and an intuitive search interface, with support for custom rules.

A powerful query language that requires advanced knowledge to use.

A large number of third-party integrations, even if they require complex configuration.

A company is designing a logging architecture for a new cloud-native application. They need to capture security-relevant events from the application, the underlying compute platform, and the cloud provider's control plane. Which set of log sources should they include to cover all three layers?

Only container runtime logs and cloud provider audit logs.

Only application logs and network flow logs.

Application logs, container runtime logs, and cloud provider audit logs.

Only cloud provider audit logs.

Which of the following is an example of a correlation rule?

Alert when more than five failed login attempts occur within five minutes from the same IP address

Alert when a single log entry contains the word 'error'

Alert when a log file is rotated

Alert when a server's CPU usage exceeds 90%

GIAC Cloud Security Architecture and Design

Domain 4Objective 1

Comprehensive Logging and Aggregation GCAD Practice Questions (Page 3)

Part of the Logging, Monitoring, and Incident Response domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

Questions 11–15

11application · medium
A security analyst notices a spike in failed login attempts to a cloud application, followed by a successful login from an unusual location, and then a large download from a database. Which type of correlation would most effectively identify this as a potential attack?
Select an answer first
12application · medium
During an incident investigation, an analyst needs to reconstruct the exact sequence of actions taken by an attacker in a cloud environment. The attacker is known to have used the AWS CLI. Which log source would provide the most detailed and authoritative timeline of the attacker's API calls?
Select an answer first
13application · medium
A security team is selecting a centralized log management tool. They have a small team with limited security expertise and need to quickly identify common attacks. They also want to retain the ability to create custom detection rules later. Which tool capability is most important?
Select an answer first
14application · medium
A company is designing a logging architecture for a new cloud-native application. They need to capture security-relevant events from the application, the underlying compute platform, and the cloud provider's control plane. Which set of log sources should they include to cover all three layers?
Select an answer first
15foundation · easy
Which of the following is an example of a correlation rule?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.