AWS Networking, VMs, and Storage GCFR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In a forensic investigation, which AWS service or feature would you review to see the rules that are currently applied to an EC2 instance's network traffic?

   • AAWS Config
   • BVPC Flow Logs
   • CAWS CloudTrail
   • DSecurity groups
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In an Amazon Virtual Private Cloud (VPC), what is the primary purpose of a route table?

   • AIt provides a logical grouping of instances that share a common security posture.
   • BIt defines which subnets are public or private based on the presence of an internet gateway.
   • CIt controls inbound and outbound traffic at the instance level using allow and deny rules.
   • DIt contains a set of rules, called routes, that determine where network traffic from a subnet or gateway is directed.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A responder is investigating a compromised EC2 instance that was in a public subnet. The instance's security group allows inbound HTTP from 0.0.0.0/0. The responder wants to determine if the attacker used a specific source IP address. Which combination of data sources would provide the most direct evidence of this?

   • AVPC Flow Logs and the instance's OS-level web server logs
   • BThe instance's system logs and the CloudTrail logs
   • CThe VPC's route tables and the instance's metadata
   • DThe security group rules and the network ACL rules
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   An organization uses AWS Storage Gateway (volume gateway) to back up on-premises data to S3. During an incident, an investigator needs to acquire a point-in-time copy of a volume that was stored in the gateway. The gateway is configured with a volume that has been snapshotted to S3. What is the most appropriate method to acquire the data?

   • AAccess the S3 bucket directly and copy the snapshot objects.
   • BMount the snapshot directly to an on-premises server using iSCSI.
   • CUse the Storage Gateway console to download the snapshot as a VHD file.
   • DCreate a new EBS volume from the snapshot in the gateway's S3 bucket and attach it to a forensic instance.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of enabling S3 server access logging for a forensic investigation?

   • ATo capture the contents of objects stored in the bucket for data recovery.
   • BTo store a backup of all objects in the bucket.
   • CTo provide a real-time alert when an object is deleted.
   • DTo record detailed information about requests made to an S3 bucket, such as requester IP, action, and response status.
   Reveal Solution Discussion Select an answer first