Which AWS service is designed to orchestrate multi-step workflows that involve multiple AWS services, such as a forensic response that includes isolating an instance, taking a snapshot, and analyzing logs?

Amazon Simple Workflow Service (SWF)

A security engineer is investigating a change to an EC2 instance's security group that allowed inbound traffic from an unknown IP. The engineer needs to determine who made the change and when. The engineer also wants to establish a baseline of the security group configuration before the change. Which combination of services should the engineer use?

Use VPC Flow Logs to see the traffic that was allowed by the new rule.

Use AWS Config to find the API call that made the change.

Use CloudTrail to find the API call that modified the security group, and use AWS Config to review the configuration history of the security group.

Use GuardDuty to identify the unknown IP as a threat.

A forensic investigator has created an EBS snapshot of a compromised instance. The snapshot must be preserved as evidence and remain unaltered for a potential legal case. Which set of actions should the investigator take to ensure the snapshot's integrity and chain of custody?

Tag the snapshot with a case ID and store it in the same account with no additional controls.

Create an AMI from the snapshot and share it publicly for transparency.

Copy the snapshot to a dedicated evidence bucket in S3, enable versioning, and apply a legal hold.

Store the snapshot in a private S3 bucket without versioning or object lock.

Which of the following is a best practice for preserving forensic evidence in AWS to maintain chain of custody?

Delete evidence after the incident is resolved to reduce costs

Store evidence in a publicly accessible S3 bucket for easy sharing

Use the same S3 bucket for evidence and production data

Enable S3 object versioning and bucket versioning on the evidence bucket

GIAC Cloud Forensics Responder

Domain 4Objective 3

In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 3)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

12concepts

Questions 11–15

11foundation · easy
Which AWS service is designed to orchestrate multi-step workflows that involve multiple AWS services, such as a forensic response that includes isolating an instance, taking a snapshot, and analyzing logs?
Select an answer first
12expert · hard
A security engineer is investigating a change to an EC2 instance's security group that allowed inbound traffic from an unknown IP. The engineer needs to determine who made the change and when. The engineer also wants to establish a baseline of the security group configuration before the change. Which combination of services should the engineer use?
Select an answer first
13foundation · easy
In AWS Step Functions, what is the name of the JSON document that defines the steps, branching, and error handling of an orchestrated workflow?
Select an answer first
14application · medium
A forensic investigator has created an EBS snapshot of a compromised instance. The snapshot must be preserved as evidence and remain unaltered for a potential legal case. Which set of actions should the investigator take to ensure the snapshot's integrity and chain of custody?
Select an answer first
15foundation · easy
Which of the following is a best practice for preserving forensic evidence in AWS to maintain chain of custody?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 3)

Questions 11–15

Which AWS service is designed to orchestrate multi-step workflows that involve multiple AWS services, such as a forensic response that includes isolating an instance, taking a snapshot, and analyzing logs?

In AWS Step Functions, what is the name of the JSON document that defines the steps, branching, and error handling of an orchestrated workflow?

A forensic investigator has created an EBS snapshot of a compromised instance. The snapshot must be preserved as evidence and remain unaltered for a potential legal case. Which set of actions should the investigator take to ensure the snapshot's integrity and chain of custody?

Which of the following is a best practice for preserving forensic evidence in AWS to maintain chain of custody?

Keep studying — Amazon Web Services Forensics