A forensic analyst is analyzing VPC Flow Logs to identify a potential data exfiltration. The analyst notices that a large amount of data was transferred from an EC2 instance to an external IP address. Which of the following is the MOST likely indicator of compromise?

The data transfer used HTTPS protocol.

The external IP address is in a known malicious IP list.

The data transfer occurred during business hours.

The data transfer was from an EC2 instance in a private subnet.

Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility when performing forensic data acquisition from an Amazon EC2 instance?

Configuring the operating system and applications on the EC2 instance

Providing the network infrastructure that connects the EC2 instance

Securing the physical data center that hosts the EC2 instance

Managing the hypervisor that runs the EC2 instance

A forensic investigator is collecting evidence from a compromised EC2 instance. The investigator needs to collect the instance's metadata, such as the instance ID, AMI ID, and instance type. Which of the following is the BEST method to collect this information?

Use the instance's /proc/cpuinfo file.

Use the instance's system logs (console output).

Use the AWS CLI to describe the instance.

GIAC Cloud Forensics Responder

Domain 4Objective 1

Understanding IR in AWS GCFR Practice Questions (Page 4)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

Questions 16–20

16application · medium
A forensic analyst is analyzing VPC Flow Logs to identify a potential data exfiltration. The analyst notices that a large amount of data was transferred from an EC2 instance to an external IP address. Which of the following is the MOST likely indicator of compromise?
Select an answer first
17foundation · easy
Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility when performing forensic data acquisition from an Amazon EC2 instance?
Select an answer first
18application · medium
A forensic investigator is collecting evidence from a compromised EC2 instance. The investigator needs to collect the instance's metadata, such as the instance ID, AMI ID, and instance type. Which of the following is the BEST method to collect this information?
Select an answer first
19expert · hard · select all that apply
An organization is designing a forensic data collection strategy for their AWS environment. Which of the following services or features should be enabled to ensure comprehensive forensic data coverage? Select all that apply.
Select an answer first
20foundation · easy
Which AWS service records API activity in an AWS account, such as who made a request, when it was made, and from which IP address?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Understanding IR in AWS GCFR Practice Questions (Page 4)

Questions 16–20

A forensic analyst is analyzing VPC Flow Logs to identify a potential data exfiltration. The analyst notices that a large amount of data was transferred from an EC2 instance to an external IP address. Which of the following is the MOST likely indicator of compromise?

Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility when performing forensic data acquisition from an Amazon EC2 instance?

A forensic investigator is collecting evidence from a compromised EC2 instance. The investigator needs to collect the instance's metadata, such as the instance ID, AMI ID, and instance type. Which of the following is the BEST method to collect this information?

An organization is designing a forensic data collection strategy for their AWS environment. Which of the following services or features should be enabled to ensure comprehensive forensic data coverage? Select all that apply.

Which AWS service records API activity in an AWS account, such as who made a request, when it was made, and from which IP address?

Keep studying — Amazon Web Services Forensics