A company has a multi-account AWS organization. A compromised IAM role in the 'production' account is being used to launch unauthorized EC2 instances. The security team needs to contain the incident across multiple accounts while preserving evidence. Which action is MOST effective for containment?

Modify the VPC NACL in the production account to block all traffic to and from the unauthorized instances.

Apply an SCP to the production account that denies the ability to launch EC2 instances, and take snapshots of any unauthorized instances.

Terminate all EC2 instances in the production account and restore from backups.

Delete the compromised IAM role and all its associated policies.

A security team is investigating a breach that involved a serverless function in AWS Lambda. The team needs to collect forensic evidence. Which challenge is UNIQUE to serverless environments compared to traditional VMs?

The function's network traffic cannot be monitored.

The function's code is not accessible to the customer.

The function's logs are not retained by the cloud provider.

The function's runtime environment is ephemeral and may be destroyed after execution.

After a security incident, a company conducts a post-incident review. The review finds that the incident response team lacked access to a centralized log repository during the incident because the repository was in a different cloud region and required multi-factor authentication. Which lesson learned should be prioritized?

Require incident responders to use a VPN to access the log repository.

Move all logs to a single region to simplify access.

Pre-stage access to log repositories and ensure incident responders have break-glass access.

Disable multi-factor authentication for incident responders during an incident.

After a major security incident involving a compromised CI/CD pipeline, the incident response team has completed containment and eradication. The team is now in the 'lessons learned' phase. Which activity is MOST critical to ensure the incident does not recur?

Update the incident response playbook with the specific steps taken and the timeline of events.

Conduct a training session for all developers on secure coding practices.

Implement a new security control, such as requiring multi-factor authentication for all CI/CD pipeline access, and verify its effectiveness.

Reimage all CI/CD servers and restore them from the latest known-good backup.

GIAC Cloud Security Architecture and Design

Domain 4Objective 3

Incident Response in the Cloud GCAD Practice Questions (Page 2)

Part of the Logging, Monitoring, and Incident Response domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 6–10

6expert · hard
A company has a multi-account AWS organization. A compromised IAM role in the 'production' account is being used to launch unauthorized EC2 instances. The security team needs to contain the incident across multiple accounts while preserving evidence. Which action is MOST effective for containment?
Select an answer first
7application · medium
A security team is investigating a breach that involved a serverless function in AWS Lambda. The team needs to collect forensic evidence. Which challenge is UNIQUE to serverless environments compared to traditional VMs?
Select an answer first
8application · medium
After a security incident, a company conducts a post-incident review. The review finds that the incident response team lacked access to a centralized log repository during the incident because the repository was in a different cloud region and required multi-factor authentication. Which lesson learned should be prioritized?
Select an answer first
9foundation · easy
Which characteristic of cloud environments creates a unique challenge for incident responders because resources can be created, modified, or destroyed on demand?
Select an answer first
10application · medium
After a major security incident involving a compromised CI/CD pipeline, the incident response team has completed containment and eradication. The team is now in the 'lessons learned' phase. Which activity is MOST critical to ensure the incident does not recur?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Incident Response in the Cloud GCAD Practice Questions (Page 2)

Questions 6–10

A company has a multi-account AWS organization. A compromised IAM role in the 'production' account is being used to launch unauthorized EC2 instances. The security team needs to contain the incident across multiple accounts while preserving evidence. Which action is MOST effective for containment?

A security team is investigating a breach that involved a serverless function in AWS Lambda. The team needs to collect forensic evidence. Which challenge is UNIQUE to serverless environments compared to traditional VMs?

Which characteristic of cloud environments creates a unique challenge for incident responders because resources can be created, modified, or destroyed on demand?

After a major security incident involving a compromised CI/CD pipeline, the incident response team has completed containment and eradication. The team is now in the 'lessons learned' phase. Which activity is MOST critical to ensure the incident does not recur?

Keep studying — Logging, Monitoring, and Incident Response