AWS Networking, VMs, and Storage GCFR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During an incident investigation, a responder discovers that an EC2 instance in a private subnet was compromised. The instance's security group allows inbound SSH from 0.0.0.0/0, and the network ACL allows all traffic. The responder needs to determine whether the attacker could have reached the instance directly from the internet. Which additional VPC component must be checked to answer this question?

   • AThe VPC's DHCP options set
   • BThe instance's OS firewall configuration
   • CThe route table associated with the private subnet
   • DThe instance's IAM role permissions
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key forensic consideration when investigating data stored in AWS Storage Gateway?

   • AData may reside both on-premises and in AWS, so both locations must be considered.
   • BData is only stored in AWS and cannot be accessed on-premises.
   • CData is encrypted and cannot be forensically analyzed.
   • DData is automatically deleted after 30 days.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A forensic analyst is investigating a suspected data exfiltration from an EC2 instance. VPC Flow Logs are enabled and published to CloudWatch Logs. The analyst needs to determine if the instance communicated with a known malicious IP address on port 443. Which approach is most efficient?

   • AUse CloudWatch Logs Insights to query flow log data for the destination IP and port 443.
   • BDownload all flow log data to a local machine and use grep to search for the IP.
   • CUse AWS CloudTrail to search for EC2 API calls from the instance.
   • DReview the instance's security group rules to see if port 443 is allowed.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An investigator needs to analyze the root volume of a compromised EC2 instance. The instance is in an Auto Scaling group, and the volume is encrypted with a customer-managed KMS key. The investigator has created a snapshot of the volume and needs to attach it to an analysis instance in a different AWS account. Which steps are required to successfully attach the volume?

   • ACreate a volume from the snapshot in the original account, then share the volume
   • BShare the snapshot with the target account, and grant the target account's KMS key permissions to decrypt the snapshot
   • CCopy the snapshot to the target account, then create a volume from it
   • DDecrypt the snapshot in the original account, then share the unencrypted snapshot
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A forensic investigator is examining an S3 bucket that was used to store sensitive documents. The bucket has versioning enabled, and server access logging is enabled and delivered to a logging bucket. The investigator needs to determine if a specific object was downloaded by an external user during a specific time window. Which combination of evidence would provide the most definitive answer?

   • AReview server access logs for GET requests on the object and correlate with the requester's IP address.
   • BLook at the object's metadata for last accessed date.
   • CCheck the object's version history to see if a new version was created during the window.
   • DUse CloudTrail management events to see if the bucket policy was changed.
   Reveal Solution Discussion Select an answer first