A security architect is comparing Azure Activity Log and AWS CloudTrail for a compliance audit. They need to provide evidence of who accessed a storage account in Azure and who accessed an S3 bucket in AWS. Both services must be configured to capture the required events. What is the key difference in configuration?

Azure Activity Log requires enabling diagnostic settings to send data-plane events to Log Analytics, while CloudTrail requires enabling data events on the trail.

Azure Activity Log uses a single global log, while CloudTrail requires a separate trail for each region.

Azure Activity Log captures data-plane events by default, while CloudTrail requires enabling data events for S3.

Azure Activity Log captures all events automatically, while CloudTrail requires manual setup for all events.

A security team is investigating a potential unauthorized access to an S3 bucket. They have CloudTrail logs, but they notice that some S3 API calls are missing. They suspect that the bucket is not logging all events. What is the most likely reason for the missing events?

The S3 bucket is in a different AWS account than the CloudTrail trail.

CloudTrail is not enabled for the region where the bucket is located.

The S3 bucket is using server-side encryption, which prevents logging.

S3 data events are not logged by default in CloudTrail.

A security analyst is using Azure Log Analytics to investigate a security incident. They need to query logs from multiple workspaces that are in different subscriptions. What is the most efficient way to query across these workspaces?

Export all logs to a single workspace and query there.

Use Azure Data Explorer to query all workspaces.

Query each workspace separately and manually combine results.

Use a cross-workspace query with the workspace() expression.

A security architect is evaluating logging services in Azure and AWS for a new multi-cloud environment. The architect needs to ensure that all control-plane operations are logged, and that network traffic metadata is captured for both clouds. Which services should be enabled? (Select all that apply.)

Azure Network Watcher flow logs

GIAC Certified Detection Analyst

Domain 2Objective 1

Azure and AWS Logging Overview GCDA Practice Questions (Page 5)

Part of the Cloud and Microsoft Security Analytics domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

3concepts

Questions 21–25

21foundation · easy
A security analyst needs to query Azure resource logs and metrics together in a single KQL query to investigate a potential compromise. Which Azure service provides the workspace and query language for this type of analysis?
Select an answer first
22expert · hard
A security architect is comparing Azure Activity Log and AWS CloudTrail for a compliance audit. They need to provide evidence of who accessed a storage account in Azure and who accessed an S3 bucket in AWS. Both services must be configured to capture the required events. What is the key difference in configuration?
Select an answer first
23expert · hard
A security team is investigating a potential unauthorized access to an S3 bucket. They have CloudTrail logs, but they notice that some S3 API calls are missing. They suspect that the bucket is not logging all events. What is the most likely reason for the missing events?
Select an answer first
24expert · medium
A security analyst is using Azure Log Analytics to investigate a security incident. They need to query logs from multiple workspaces that are in different subscriptions. What is the most efficient way to query across these workspaces?
Select an answer first
25expert · medium · select all that apply
A security architect is evaluating logging services in Azure and AWS for a new multi-cloud environment. The architect needs to ensure that all control-plane operations are logged, and that network traffic metadata is captured for both clouds. Which services should be enabled? (Select all that apply.)
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Azure and AWS Logging Overview GCDA Practice Questions (Page 5)

Questions 21–25

A security analyst needs to query Azure resource logs and metrics together in a single KQL query to investigate a potential compromise. Which Azure service provides the workspace and query language for this type of analysis?

A security team is investigating a potential unauthorized access to an S3 bucket. They have CloudTrail logs, but they notice that some S3 API calls are missing. They suspect that the bucket is not logging all events. What is the most likely reason for the missing events?

A security analyst is using Azure Log Analytics to investigate a security incident. They need to query logs from multiple workspaces that are in different subscriptions. What is the most efficient way to query across these workspaces?

Keep studying — Cloud and Microsoft Security Analytics