GIAC Certified Detection Analyst
Domain 2Objective 1
Azure and AWS Logging Overview GCDA Practice Questions (Page 1)
Part of the Cloud and Microsoft Security Analytics domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)
31questions here
7free pages
3concepts
Questions 1–5
- 1
A security analyst needs to monitor the CPU utilization of an EC2 instance and set an alarm when it exceeds 80% for 10 minutes. Which AWS service should be used to create this alarm?
Select an answer first - 2
Which Azure service is specifically designed to capture subscription-level control plane events, such as creating a virtual machine or modifying a network security group, and is retained for 90 days by default?
Select an answer first - 3
A security architect is comparing Azure and AWS logging services to design a unified logging strategy. They need a service that provides a centralized query interface for logs from multiple sources and supports advanced analytics. Which pair of services, one from each cloud, best fulfills this role?
Select an answer first - 4
A security analyst needs to investigate a suspected credential-stuffing attack against Azure AD. They must determine which accounts were targeted, whether any sign-ins succeeded, and correlate the sign-in events with Azure resource modifications that occurred during the same time window. Which Azure logging service should be the primary source for the sign-in data?
Select an answer first - 5
A security analyst needs to collect and analyze Windows event logs from Azure VMs to detect malicious activity. They want to use a single Azure service to ingest and query these logs. Which service should they use?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.