AWS Networking, VMs, and Storage GCFR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Where can VPC Flow Logs be published for forensic analysis and long-term retention?

   • AAmazon DynamoDB or Amazon ElastiCache
   • BAWS Lambda or Amazon ECS
   • CAWS CloudTrail or AWS Config
   • DAmazon CloudWatch Logs or Amazon S3
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A forensic investigator is analyzing an S3 bucket that was used to store sensitive files. The bucket has versioning enabled, but server access logging was not enabled. The investigator needs to determine if a specific object was overwritten during the incident. What is the best source of evidence?

   • ALook at the object's metadata for last modified date.
   • BUse the S3 inventory report to see the object's current state.
   • CCheck the bucket's CloudTrail data events for PutObject calls.
   • DReview the object's version history to see if a new version was created.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is investigating a suspected data exfiltration from an EC2 instance in a private subnet. The instance communicates with an internet-facing service through a NAT gateway. The analyst needs to determine which internal IP addresses initiated outbound connections to a specific external IP during the incident window. VPC Flow Logs are not yet enabled. What is the most efficient way to obtain this historical connection data?

   • ARun tcpdump on the EC2 instance to capture live traffic and compare with current connections.
   • BEnable VPC Flow Logs on the subnet and wait for new logs to be generated.
   • CUse AWS CloudTrail to review EC2 API calls and infer connections from instance launches.
   • DCheck the VPC Flow Logs in the S3 bucket that were already being delivered to a central logging account.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which S3 feature allows you to recover a previous version of an object that was accidentally overwritten or deleted?

   • AS3 Object Lock
   • BS3 Versioning
   • CS3 Lifecycle policies
   • DS3 Cross-Region Replication
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A forensic investigator is analyzing an S3 bucket that was used for data exfiltration. The bucket has versioning enabled, and the investigator has identified a suspicious object. The investigator needs to determine the original version of the object before it was modified. Which approach provides the most complete evidence?

   • AUse the bucket's lifecycle policy to restore the original version
   • BUse the bucket's access logs to reconstruct the original object
   • CCheck the object's metadata for the original creation date
   • DList all versions of the object and download the earliest version
   Reveal Solution Discussion Select an answer first