A security team wants to automate the initial response to a known malicious file upload to an S3 bucket. The response should isolate the file, notify the team, and prevent further uploads of the same file. Which combination of AWS services would BEST achieve this?

S3 bucket policy to deny all uploads, and a separate CloudWatch alarm to notify the team.

AWS Config rule to detect the file and automatically terminate the EC2 instance that uploaded it.

CloudWatch Events to trigger an AWS Lambda function that deletes the file and sends an SNS notification.

S3 Event Notification to trigger an AWS Lambda function that moves the file to a quarantine bucket, adds a deny rule to the bucket policy, and sends an SNS notification.

A company's security team has detected a compromised EC2 instance that is part of a larger application. The instance is communicating with a known command-and-control server. The team needs to contain the incident while minimizing impact on the rest of the application. Which action is MOST appropriate?

Modify the instance's security group to deny all outbound traffic, and take a snapshot of the EBS volume.

Terminate the instance and rely on the load balancer to route traffic to other instances.

Create an AMI of the instance and then stop it.

Detach the instance from the target group and leave it running.

A company uses a cloud provider's managed Kubernetes service (e.g., EKS). A security incident is detected in a pod. The incident response team needs to collect evidence. Which challenge is MOST likely to be encountered?

The pod's ephemeral storage is lost when the pod is terminated, and the customer has limited access to the underlying node.

The provider is responsible for collecting all evidence from the pod, including the application logs.

The customer cannot access the pod's logs because they are managed by the provider.

The customer is responsible for collecting evidence from the underlying node's OS and kernel.

During an incident, a security analyst discovers that a compromised EC2 instance is communicating with a known command-and-control IP. The instance is part of an auto scaling group and is behind an Application Load Balancer. The analyst needs to contain the threat while preserving evidence for later forensic analysis. Which action should the analyst take FIRST?

Modify the security group to deny all outbound traffic to the C2 IP.

Remove the instance from the target group of the load balancer.

Terminate the instance immediately to stop the communication with the C2 server.

Create a snapshot of the instance's EBS volumes and detach the instance from the auto scaling group.

GIAC Cloud Security Architecture and Design

Domain 4Objective 3

Incident Response in the Cloud GCAD Practice Questions (Page 3)

Part of the Logging, Monitoring, and Incident Response domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 11–15

11foundation · easy
During which phase of the incident response lifecycle does an organization restore systems from clean backups and validate that they operate as expected?
Select an answer first
12application · medium
A security team wants to automate the initial response to a known malicious file upload to an S3 bucket. The response should isolate the file, notify the team, and prevent further uploads of the same file. Which combination of AWS services would BEST achieve this?
Select an answer first
13application · medium
A company's security team has detected a compromised EC2 instance that is part of a larger application. The instance is communicating with a known command-and-control server. The team needs to contain the incident while minimizing impact on the rest of the application. Which action is MOST appropriate?
Select an answer first
14application · medium
A company uses a cloud provider's managed Kubernetes service (e.g., EKS). A security incident is detected in a pod. The incident response team needs to collect evidence. Which challenge is MOST likely to be encountered?
Select an answer first
15application · medium
During an incident, a security analyst discovers that a compromised EC2 instance is communicating with a known command-and-control IP. The instance is part of an auto scaling group and is behind an Application Load Balancer. The analyst needs to contain the threat while preserving evidence for later forensic analysis. Which action should the analyst take FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Incident Response in the Cloud GCAD Practice Questions (Page 3)

Questions 11–15

During which phase of the incident response lifecycle does an organization restore systems from clean backups and validate that they operate as expected?

A security team wants to automate the initial response to a known malicious file upload to an S3 bucket. The response should isolate the file, notify the team, and prevent further uploads of the same file. Which combination of AWS services would BEST achieve this?

A company uses a cloud provider's managed Kubernetes service (e.g., EKS). A security incident is detected in a pod. The incident response team needs to collect evidence. Which challenge is MOST likely to be encountered?

Keep studying — Logging, Monitoring, and Incident Response