AWS Networking, VMs, and Storage GCFR Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the key difference between a security group and a network ACL in AWS?

   • ASecurity groups are stateless, while network ACLs are stateful.
   • BSecurity groups support allow and deny rules, while network ACLs only support allow rules.
   • CSecurity groups are stateful and operate at the instance level, while network ACLs are stateless and operate at the subnet level.
   • DSecurity groups operate at the subnet level, while network ACLs operate at the instance level.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization uses AWS Storage Gateway (file gateway) to provide on-premises applications with access to S3-backed file shares. During an incident, an investigator needs to acquire forensic evidence of files that were recently modified through the gateway. What is the most appropriate acquisition method?

   • ACreate a point-in-time snapshot of the file share's underlying S3 bucket using the Storage Gateway console.
   • BUse the Storage Gateway's local cache to recover deleted files.
   • CEnable S3 versioning on the bucket and then copy the bucket to a forensic account.
   • DAccess the S3 bucket directly and review object metadata and versions, if versioning was enabled.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During an incident investigation, a forensic analyst needs to determine whether a compromised EC2 instance could have received inbound traffic from the internet on port 22. The instance is in a public subnet with an internet gateway attached. Which two configurations must be reviewed to make this determination?

   • AThe VPC Flow Logs and the instance's user data
   • BThe internet gateway and the instance's EBS volume encryption
   • CThe route table and the instance's IAM role
   • DThe instance's security group and the subnet's network ACL
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A forensic investigator is analyzing a VPC where an EC2 instance was compromised. The instance is in a private subnet, and the investigator needs to determine if the instance could have been accessed from the internet. The VPC has a NAT gateway, and the private subnet's route table points to the NAT gateway for 0.0.0.0/0. What is the most likely way the instance could have received inbound internet traffic?

   • AThe instance has a public IP address and is in a public subnet.
   • BThe instance is behind a load balancer that forwards traffic to it.
   • CThe security group allows inbound traffic from the internet.
   • DThe network ACL allows inbound traffic from the internet.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the first step in acquiring forensic data from an EC2 instance's EBS volumes?

   • ATerminate the instance to ensure the volume is not in use.
   • BCopy the instance's instance metadata to an S3 bucket.
   • CDetach the EBS volume from the instance and attach it to a forensic workstation.
   • DCreate a snapshot of the EBS volumes.
   Reveal Solution Discussion Select an answer first