A multi-cloud organization wants to centralize security logs from Azure and AWS into a single analytics platform. They need to retain logs for 7 years to meet compliance, but they also want to run interactive queries on recent data. Which design best balances cost and functionality?

Use a SIEM for interactive analysis and archive raw logs to low-cost object storage for 7 years.

Send all logs to Azure Log Analytics and set the retention to 7 years.

Send all logs to AWS CloudWatch Logs with a 7-year retention policy.

Store logs in each cloud's native storage and query them separately when needed.

A company uses both Azure and AWS. They want to detect brute-force attacks against their cloud management consoles. Which logs should be analyzed to identify failed login attempts?

AWS CloudWatch Logs and Azure Diagnostic Logs

Azure Monitor metrics and AWS CloudWatch metrics

Azure Activity Log and AWS CloudTrail

VPC Flow Logs and Azure Network Watcher

An AWS organization has multiple accounts. The security team wants to enable a single CloudTrail trail that captures management events for all accounts and delivers them to a centralized S3 bucket. Which configuration is required?

Enable CloudTrail in each account and manually copy logs to a central bucket.

Create an organization trail in the management account with the 'Apply trail to all accounts' option.

Use CloudWatch Logs to collect CloudTrail logs from each account.

Use AWS Config to aggregate logs from all accounts.

A company operates a hybrid environment with workloads in both Azure and AWS. The security team wants to centralize security monitoring and correlate sign-in events from Azure AD with API calls made in AWS. Which approach best supports this requirement?

Use AWS CloudWatch Logs Insights to query Azure AD logs after enabling a direct streaming integration.

Export Azure AD logs to AWS S3 and use Amazon Athena to query them alongside CloudTrail logs.

Use Azure Sentinel (Microsoft Sentinel) as the central SIEM, connecting both Azure AD and AWS CloudTrail data sources.

Enable Azure AD diagnostic settings to send sign-in logs to a Log Analytics workspace, and enable CloudTrail to send events to the same workspace via an Event Hub.

GIAC Certified Detection Analyst

Domain 2Objective 1

Azure and AWS Logging Overview GCDA Practice Questions (Page 3)

Part of the Cloud and Microsoft Security Analytics domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

3concepts

Questions 11–15

11application · medium
A multi-cloud organization wants to centralize security logs from Azure and AWS into a single analytics platform. They need to retain logs for 7 years to meet compliance, but they also want to run interactive queries on recent data. Which design best balances cost and functionality?
Select an answer first
12application · medium
A company uses both Azure and AWS. They want to detect brute-force attacks against their cloud management consoles. Which logs should be analyzed to identify failed login attempts?
Select an answer first
13expert · medium
An AWS organization has multiple accounts. The security team wants to enable a single CloudTrail trail that captures management events for all accounts and delivers them to a centralized S3 bucket. Which configuration is required?
Select an answer first
14application · medium
A security analyst needs to identify which user stopped a virtual machine in Azure and when. The VM is in a resource group with multiple users who have Contributor permissions. Which Azure log should the analyst query?
Select an answer first
15application · medium
A company operates a hybrid environment with workloads in both Azure and AWS. The security team wants to centralize security monitoring and correlate sign-in events from Azure AD with API calls made in AWS. Which approach best supports this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.