A small company is moving its infrastructure to AWS. The security team is developing an incident response plan. Which of the following is a key principle of incident response in the AWS cloud that the team should incorporate?

Rely solely on third-party tools for incident response.

Focus on on-premises incident response procedures only.

Assume that AWS will handle all incident response activities.

Leverage AWS services and features to collect and analyze forensic data.

A company has experienced a security incident involving an EC2 instance. The incident response team is designing a forensic investigation workflow. The team needs to ensure that the workflow includes steps for preserving evidence, analyzing data, and reporting findings. Which of the following is the MOST important consideration when designing the workflow?

The workflow should ensure that evidence is collected and preserved in a forensically sound manner.

The workflow should be flexible enough to adapt to different types of incidents.

The workflow should be automated as much as possible.

The workflow should prioritize speed over thoroughness.

GIAC Cloud Forensics Responder

Domain 4Objective 1

Understanding IR in AWS GCFR Practice Questions (Page 3)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

Questions 11–15

11foundation · easy
Which AWS service can be used to analyze VPC Flow Logs to identify unusual network traffic patterns, such as large data exfiltration?
Select an answer first
12application · medium
A small company is moving its infrastructure to AWS. The security team is developing an incident response plan. Which of the following is a key principle of incident response in the AWS cloud that the team should incorporate?
Select an answer first
13foundation · easy
Which AWS feature provides a point-in-time, block-level copy of an Amazon EBS volume that can be used for forensic analysis?
Select an answer first
14expert · hard
A company has experienced a security incident involving an EC2 instance. The incident response team is designing a forensic investigation workflow. The team needs to ensure that the workflow includes steps for preserving evidence, analyzing data, and reporting findings. Which of the following is the MOST important consideration when designing the workflow?
Select an answer first
15foundation · easy
When analyzing CloudTrail logs to reconstruct an incident, which of the following fields is most useful for identifying the source of an API call?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Understanding IR in AWS GCFR Practice Questions (Page 3)

Questions 11–15

Which AWS service can be used to analyze VPC Flow Logs to identify unusual network traffic patterns, such as large data exfiltration?

A small company is moving its infrastructure to AWS. The security team is developing an incident response plan. Which of the following is a key principle of incident response in the AWS cloud that the team should incorporate?

Which AWS feature provides a point-in-time, block-level copy of an Amazon EBS volume that can be used for forensic analysis?

When analyzing CloudTrail logs to reconstruct an incident, which of the following fields is most useful for identifying the source of an API call?

Keep studying — Amazon Web Services Forensics