A company uses AWS with a multi-account strategy. The security team wants to detect and alert on suspicious IAM activity across all accounts in near real time. They currently have CloudTrail enabled in each account. Which configuration should they implement?

Send CloudTrail logs from all accounts to a centralized S3 bucket and use Amazon GuardDuty with AWS Organizations to analyze findings.

Create a Lambda function in each account that parses CloudTrail logs and sends alerts to a central SIEM.

Enable AWS Config rules in each account to monitor IAM policy changes and send alerts via SNS.

Use AWS Trusted Advisor to review IAM usage across accounts and generate weekly reports.

After a ransomware incident, a company decides to recover its AWS environment. The company has a multi-region deployment with RDS databases and EC2 instances. The security team wants to ensure that the recovery does not reintroduce the malware and that the recovery is fast. Which recovery strategy is BEST?

Restore the RDS databases from the latest automated backup and redeploy EC2 instances from a clean AMI.

Redeploy the entire environment using infrastructure as code from a clean repository, and restore only validated data from backups.

Use AWS Backup to restore the entire environment from a point-in-time backup taken before the incident.

Failover to the secondary region using Route 53 and AWS Global Accelerator, then promote the secondary database.

A forensic investigator needs to collect evidence from a compromised Google Cloud VM while maintaining chain of custody. The VM is running and the investigator wants to capture volatile memory and disk data. Which action should the investigator take?

Use a memory acquisition tool within the VM and then create a snapshot of the persistent disks.

Clone the VM to another project and then run forensic tools on the clone.

Create a snapshot of the persistent disks and then power off the VM.

Stop the VM and then create a snapshot of the persistent disks.

After a major cloud incident, a company conducts a post-incident review. The review reveals that the incident response team was unable to access the cloud console because the corporate identity provider was also compromised. The team had to use a break-glass account. Which improvement should be prioritized?

Implement a separate, offline identity provider for break-glass access.

Store break-glass account credentials in a secure password manager.

Disable break-glass accounts after the incident.

Require multi-factor authentication for all break-glass accounts.

GIAC Cloud Security Architecture and Design

Domain 4Objective 3

Incident Response in the Cloud GCAD Practice Questions (Page 5)

Part of the Logging, Monitoring, and Incident Response domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 21–25

21application · medium
A company uses AWS with a multi-account strategy. The security team wants to detect and alert on suspicious IAM activity across all accounts in near real time. They currently have CloudTrail enabled in each account. Which configuration should they implement?
Select an answer first
22application · medium
A security team wants to automate the containment of a compromised EC2 instance. The team has identified the instance by its tag 'Environment: Production'. Which AWS service can be used to automatically stop the instance and modify its security group?
Select an answer first
23expert · hard
After a ransomware incident, a company decides to recover its AWS environment. The company has a multi-region deployment with RDS databases and EC2 instances. The security team wants to ensure that the recovery does not reintroduce the malware and that the recovery is fast. Which recovery strategy is BEST?
Select an answer first
24application · medium
A forensic investigator needs to collect evidence from a compromised Google Cloud VM while maintaining chain of custody. The VM is running and the investigator wants to capture volatile memory and disk data. Which action should the investigator take?
Select an answer first
25expert · hard
After a major cloud incident, a company conducts a post-incident review. The review reveals that the incident response team was unable to access the cloud console because the corporate identity provider was also compromised. The team had to use a break-glass account. Which improvement should be prioritized?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Incident Response in the Cloud GCAD Practice Questions (Page 5)

Questions 21–25

A company uses AWS with a multi-account strategy. The security team wants to detect and alert on suspicious IAM activity across all accounts in near real time. They currently have CloudTrail enabled in each account. Which configuration should they implement?

A security team wants to automate the containment of a compromised EC2 instance. The team has identified the instance by its tag 'Environment: Production'. Which AWS service can be used to automatically stop the instance and modify its security group?

A forensic investigator needs to collect evidence from a compromised Google Cloud VM while maintaining chain of custody. The VM is running and the investigator wants to capture volatile memory and disk data. Which action should the investigator take?

Keep studying — Logging, Monitoring, and Incident Response