GIAC Cloud Forensics Responder
Domain 4Objective 3
In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 1)
Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)
44questions here
9free pages
12concepts
Questions 1–5
- 1
In an EventBridge rule, what is the component that receives the event and performs the automated response, such as invoking a Lambda function?
Select an answer first - 2
During an incident response in AWS, which AWS service provides the customer with visibility into AWS-side actions, such as API calls made by AWS support or the AWS console, that may be relevant to the investigation?
Select an answer first - 3
Which AWS CloudTrail log field uniquely identifies the AWS account that made an API call, helping you attribute actions during an incident?
Select an answer first - 4
Which AWS service continuously analyzes AWS account activity and generates security findings, such as suspicious API calls or compromised EC2 instances, that can be used to trigger automated incident response?
Select an answer first - 5
Which AWS service can be used to create rules that trigger automated actions in response to specific API calls, such as an unauthorized attempt to delete an S3 bucket?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.