During an investigation, you have CloudTrail logs showing that an IAM role was used to launch a new EC2 instance. You also have VPC Flow Logs showing traffic to an unknown IP address from that instance. Which analysis technique would best help you determine if the instance was used for data exfiltration?

Correlate the instance launch time with the start of outbound traffic to the unknown IP.

Review the instance's security group rules to see if outbound traffic is allowed.

Analyze the IAM role's permissions to see if it can access sensitive data.

Check the instance's system logs for login attempts.

A security team is preparing for incident response in AWS. They want to ensure that they have the necessary forensic data sources available. Which of the following is a BEST PRACTICE for preparing for incident response in AWS?

Disable VPC Flow Logs to reduce costs.

Store logs only in the region where the incident occurred.

Enable CloudTrail in all regions and store logs in a centralized S3 bucket.

Use only the default CloudTrail trail.

When investigating a security incident in AWS, which of the following forensic data sources is AWS responsible for providing, according to the shared responsibility model?

Application logs from a customer-managed database

CloudTrail logs of API calls made in the customer's account

Operating system logs from an EC2 instance

Physical access logs to the data center hosting the EC2 instance

Which method is commonly used to collect a non-volatile forensic artifact from an Amazon EBS volume without altering the original volume?

Terminating the instance and attaching the volume to another instance

Copying files from the volume using SCP

Running `dd` on the live volume

GIAC Cloud Forensics Responder

Domain 4Objective 1

Understanding IR in AWS GCFR Practice Questions (Page 1)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

Questions 1–5

1expert · hard
During an investigation, you have CloudTrail logs showing that an IAM role was used to launch a new EC2 instance. You also have VPC Flow Logs showing traffic to an unknown IP address from that instance. Which analysis technique would best help you determine if the instance was used for data exfiltration?
Select an answer first
2application · medium
A security team is preparing for incident response in AWS. They want to ensure that they have the necessary forensic data sources available. Which of the following is a BEST PRACTICE for preparing for incident response in AWS?
Select an answer first
3foundation · easy
In a structured AWS forensic investigation workflow, which step typically follows the collection of forensic artifacts?
Select an answer first
4foundation · easy
When investigating a security incident in AWS, which of the following forensic data sources is AWS responsible for providing, according to the shared responsibility model?
Select an answer first
5foundation · easy
Which method is commonly used to collect a non-volatile forensic artifact from an Amazon EBS volume without altering the original volume?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Understanding IR in AWS GCFR Practice Questions (Page 1)

Questions 1–5

A security team is preparing for incident response in AWS. They want to ensure that they have the necessary forensic data sources available. Which of the following is a BEST PRACTICE for preparing for incident response in AWS?

In a structured AWS forensic investigation workflow, which step typically follows the collection of forensic artifacts?

When investigating a security incident in AWS, which of the following forensic data sources is AWS responsible for providing, according to the shared responsibility model?

Which method is commonly used to collect a non-volatile forensic artifact from an Amazon EBS volume without altering the original volume?

Keep studying — Amazon Web Services Forensics