After creating an EBS snapshot for forensic purposes, what is the recommended way to analyze the data without altering the original evidence?

Create a new EBS volume from the snapshot and attach it to a forensic analysis instance

Copy the snapshot to an S3 bucket and use S3 analytics

Mount the snapshot as a file system on the original instance

Attach the snapshot directly to a running EC2 instance

A security analyst is investigating a potential data exfiltration from an EC2 instance. The analyst has enabled VPC Flow Logs for the VPC, but the logs are not showing any traffic to an external IP address that was identified in threat intelligence. Which step should the analyst take to ensure the flow logs capture the relevant traffic?

Use AWS Config to monitor the instance's network interfaces for changes.

Verify that the flow logs are attached to the correct subnet or ENI and that the log format includes the destination IP and port fields.

Enable CloudTrail data events for the EC2 instance to capture network traffic.

Create a new flow log with the 'ALL' traffic type and attach it to the instance's security group.

When using AWS Config to analyze a security group change during an incident, which type of information does AWS Config provide that is most useful for forensic analysis?

The contents of the EC2 instance's memory at the time of the change

The raw network packets that traversed the security group

The full command line of the user who made the change

The previous and new configuration of the security group, along with the time of the change

GIAC Cloud Forensics Responder

Domain 4Objective 3

In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 4)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

12concepts

Questions 16–20

16foundation · easy
After creating an EBS snapshot for forensic purposes, what is the recommended way to analyze the data without altering the original evidence?
Select an answer first
17foundation · easy
To automatically initiate a forensic response when GuardDuty detects a finding, which AWS service can be used to route the finding to a Lambda function?
Select an answer first
18application · medium
A security analyst is investigating a potential data exfiltration from an EC2 instance. The analyst has enabled VPC Flow Logs for the VPC, but the logs are not showing any traffic to an external IP address that was identified in threat intelligence. Which step should the analyst take to ensure the flow logs capture the relevant traffic?
Select an answer first
19foundation · easy
When using AWS Config to analyze a security group change during an incident, which type of information does AWS Config provide that is most useful for forensic analysis?
Select an answer first
20foundation · easy
Which AWS service records a history of resource configuration changes that can be used to establish a forensic baseline of an EC2 instance's security groups?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 4)

Questions 16–20

After creating an EBS snapshot for forensic purposes, what is the recommended way to analyze the data without altering the original evidence?

To automatically initiate a forensic response when GuardDuty detects a finding, which AWS service can be used to route the finding to a Lambda function?

When using AWS Config to analyze a security group change during an incident, which type of information does AWS Config provide that is most useful for forensic analysis?

Which AWS service records a history of resource configuration changes that can be used to establish a forensic baseline of an EC2 instance's security groups?

Keep studying — Amazon Web Services Forensics