A forensic investigator is analyzing a suspected data exfiltration from an EC2 instance in a VPC. The VPC has a single public subnet with an internet gateway, and the instance has a security group allowing all outbound traffic. The investigator needs to determine which internal IP addresses communicated with the instance over the past 30 days. VPC Flow Logs were not enabled at the time of the incident. Which action would provide the most complete historical network data for this analysis?

Create a new VPC with Flow Logs enabled and migrate the instance to it

Enable VPC Flow Logs now and wait 30 days for data to accumulate

Examine the instance's OS-level network logs and any third-party agent data collected before the incident

Review the instance's security group and network ACL configuration to infer allowed traffic

A forensic team is investigating a breach where an attacker accessed an EC2 instance in a private subnet. The team has VPC Flow Logs enabled for the private subnet, but the logs show no traffic from the internet. The attacker is believed to have used a VPN connection to access the instance. Which VPC component would the attacker's traffic have traversed?

The virtual private gateway (VGW)

An organization uses Amazon EFS for shared storage across multiple EC2 instances. During an incident, an investigator needs to acquire forensic data from the EFS file system. What is the most appropriate method to acquire the data?

Create an EBS snapshot of the EFS file system.

Mount the EFS file system to a forensic EC2 instance and copy the relevant files.

Use the EFS console to download the file system as a single archive.

Copy the EFS file system to an S3 bucket using AWS DataSync.

A forensic analyst is investigating a network breach and needs to identify whether any traffic was allowed from a specific IP address to an EC2 instance on port 443. VPC Flow Logs are enabled and published to CloudWatch Logs. Which query would be most effective?

Check the instance's OS-level firewall logs.

Search CloudWatch Logs for flow log entries with the source IP and destination port 443, and check the action field.

Use AWS CloudTrail to search for EC2 AuthorizeSecurityGroupIngress API calls.

Review the instance's security group rules for inbound port 443.

GIAC Cloud Forensics Responder

Domain 4Objective 2

AWS Networking, VMs, and Storage GCFR Practice Questions (Page 4)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

7concepts

Questions 16–20

16application · medium
A forensic investigator is analyzing a suspected data exfiltration from an EC2 instance in a VPC. The VPC has a single public subnet with an internet gateway, and the instance has a security group allowing all outbound traffic. The investigator needs to determine which internal IP addresses communicated with the instance over the past 30 days. VPC Flow Logs were not enabled at the time of the incident. Which action would provide the most complete historical network data for this analysis?
Select an answer first
17expert · hard
A forensic team is investigating a breach where an attacker accessed an EC2 instance in a private subnet. The team has VPC Flow Logs enabled for the private subnet, but the logs show no traffic from the internet. The attacker is believed to have used a VPN connection to access the instance. Which VPC component would the attacker's traffic have traversed?
Select an answer first
18foundation · easy
Which AWS storage service is designed to provide a file share that can be mounted by multiple EC2 instances using the NFS protocol?
Select an answer first
19expert · medium
An organization uses Amazon EFS for shared storage across multiple EC2 instances. During an incident, an investigator needs to acquire forensic data from the EFS file system. What is the most appropriate method to acquire the data?
Select an answer first
20application · medium
A forensic analyst is investigating a network breach and needs to identify whether any traffic was allowed from a specific IP address to an EC2 instance on port 443. VPC Flow Logs are enabled and published to CloudWatch Logs. Which query would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

AWS Networking, VMs, and Storage GCFR Practice Questions (Page 4)

Questions 16–20

Which AWS storage service is designed to provide a file share that can be mounted by multiple EC2 instances using the NFS protocol?

An organization uses Amazon EFS for shared storage across multiple EC2 instances. During an incident, an investigator needs to acquire forensic data from the EFS file system. What is the most appropriate method to acquire the data?

A forensic analyst is investigating a network breach and needs to identify whether any traffic was allowed from a specific IP address to an EC2 instance on port 443. VPC Flow Logs are enabled and published to CloudWatch Logs. Which query would be most effective?

Keep studying — Amazon Web Services Forensics