A company has just detected a potential security incident involving an EC2 instance. The incident response team needs to follow a structured workflow. Which of the following is the FIRST step in the forensic investigation workflow?

Contain the incident by isolating the instance from the network.

Identify the incident by confirming the alert and determining the scope.

Preserve evidence by creating EBS snapshots and collecting logs.

Eradicate the threat by removing malware from the instance.

A forensic investigator is analyzing a compromised EC2 instance. The investigator wants to identify the process that was running on the instance at the time of compromise. Which of the following data sources would provide this information?

EBS snapshot of the root volume

Which of the following is a core principle of incident response in the AWS cloud that emphasizes the need to preserve evidence while minimizing the impact on business operations?

Prioritize eradication over evidence collection

Immediate shutdown of all affected resources

Balance between forensic preservation and business continuity

Rely solely on automated response tools

GIAC Cloud Forensics Responder

Domain 4Objective 1

Understanding IR in AWS GCFR Practice Questions (Page 2)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

Questions 6–10

6application · medium
A company has just detected a potential security incident involving an EC2 instance. The incident response team needs to follow a structured workflow. Which of the following is the FIRST step in the forensic investigation workflow?
Select an answer first
7application · medium
A forensic investigator is analyzing a compromised EC2 instance. The investigator wants to identify the process that was running on the instance at the time of compromise. Which of the following data sources would provide this information?
Select an answer first
8foundation · easy
Which phase of the incident response process in AWS involves identifying the scope of the incident and determining which AWS resources and data are affected?
Select an answer first
9application · medium
A security analyst is investigating a potential brute-force attack on an EC2 instance. The analyst wants to identify the source IP addresses that attempted to connect to the instance. Which AWS service or feature should the analyst use?
Select an answer first
10foundation · easy
Which of the following is a core principle of incident response in the AWS cloud that emphasizes the need to preserve evidence while minimizing the impact on business operations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Understanding IR in AWS GCFR Practice Questions (Page 2)

Questions 6–10

A company has just detected a potential security incident involving an EC2 instance. The incident response team needs to follow a structured workflow. Which of the following is the FIRST step in the forensic investigation workflow?

A forensic investigator is analyzing a compromised EC2 instance. The investigator wants to identify the process that was running on the instance at the time of compromise. Which of the following data sources would provide this information?

Which phase of the incident response process in AWS involves identifying the scope of the incident and determining which AWS resources and data are affected?

A security analyst is investigating a potential brute-force attack on an EC2 instance. The analyst wants to identify the source IP addresses that attempted to connect to the instance. Which AWS service or feature should the analyst use?

Which of the following is a core principle of incident response in the AWS cloud that emphasizes the need to preserve evidence while minimizing the impact on business operations?

Keep studying — Amazon Web Services Forensics