A customer using AWS experiences a security incident that involves an S3 bucket with sensitive data. The customer suspects that the bucket policy was misconfigured. The customer requests that AWS provide forensic evidence of the bucket policy changes. According to the shared responsibility model, which statement is accurate?

AWS will restore the bucket to its previous state and provide a summary of the changes.

AWS is responsible for the bucket policy because it is part of the S3 service.

AWS will provide a detailed report of who accessed the bucket and when.

AWS will provide CloudTrail logs of the bucket policy changes, but the customer is responsible for analyzing them.

In the shared responsibility model for IaaS, which incident response action is typically the responsibility of the cloud customer?

Managing the physical network infrastructure

Preserving customer virtual machine disk snapshots

Investigating incidents on the physical host

A forensic investigator is collecting evidence from a compromised Azure VM. The VM is in a resource group that is managed by Azure Policy. The investigator needs to ensure that the evidence is preserved and that the chain of custody is maintained. Which action is MOST appropriate?

Create a snapshot of the VM's managed disks and store it in a separate resource group with restricted access.

Use Azure Site Recovery to replicate the VM to another region for analysis.

Apply a resource lock to the VM's resource group to prevent deletion or modification.

Capture a memory dump using a tool inside the VM and then create a snapshot of the managed disks.

A company's web application was compromised, and the attacker modified files on the EC2 instances. The application is deployed using AWS CloudFormation. The security team has completed containment and eradication. Which recovery step is MOST aligned with the 'infrastructure as code' principle?

Create a new AMI from a known-good instance and launch new instances from it.

Restore the EC2 instances from the latest EBS snapshots.

Update the CloudFormation template to include a user-data script that installs the latest security patches, then re-deploy the stack.

Manually SSH into each instance and remove the malicious files.

GIAC Cloud Security Architecture and Design

Domain 4Objective 3

Incident Response in the Cloud GCAD Practice Questions (Page 1)

Part of the Logging, Monitoring, and Incident Response domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 1–5

1expert · hard
A customer using AWS experiences a security incident that involves an S3 bucket with sensitive data. The customer suspects that the bucket policy was misconfigured. The customer requests that AWS provide forensic evidence of the bucket policy changes. According to the shared responsibility model, which statement is accurate?
Select an answer first
2foundation · easy
In the shared responsibility model for IaaS, which incident response action is typically the responsibility of the cloud customer?
Select an answer first
3expert · hard
A forensic investigator is collecting evidence from a compromised Azure VM. The VM is in a resource group that is managed by Azure Policy. The investigator needs to ensure that the evidence is preserved and that the chain of custody is maintained. Which action is MOST appropriate?
Select an answer first
4application · medium
A company's web application was compromised, and the attacker modified files on the EC2 instances. The application is deployed using AWS CloudFormation. The security team has completed containment and eradication. Which recovery step is MOST aligned with the 'infrastructure as code' principle?
Select an answer first
5foundation · easy
Which cloud incident response challenge is most directly caused by the customer having limited access to the underlying physical infrastructure and hypervisor logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Incident Response in the Cloud GCAD Practice Questions (Page 1)

Questions 1–5

In the shared responsibility model for IaaS, which incident response action is typically the responsibility of the cloud customer?

A forensic investigator is collecting evidence from a compromised Azure VM. The VM is in a resource group that is managed by Azure Policy. The investigator needs to ensure that the evidence is preserved and that the chain of custody is maintained. Which action is MOST appropriate?

A company's web application was compromised, and the attacker modified files on the EC2 instances. The application is deployed using AWS CloudFormation. The security team has completed containment and eradication. Which recovery step is MOST aligned with the 'infrastructure as code' principle?

Which cloud incident response challenge is most directly caused by the customer having limited access to the underlying physical infrastructure and hypervisor logs?

Keep studying — Logging, Monitoring, and Incident Response