A company uses a cloud-based object storage service to store sensitive customer data. They want to ensure that data is protected both at rest and in transit. Which combination of controls should they implement?

Enable server-side encryption and require HTTPS for all API calls.

Enable logging and monitoring on the storage service.

Enable versioning and MFA delete on the storage bucket.

Create a new IAM role with read-only access for all users.

A cloud incident response team is investigating a suspected account takeover. The team needs to determine the scope of the attack and preserve evidence. Which of the following is the most important FIRST step?

Collect and preserve authentication logs and API call logs for the affected account

Disable the affected account immediately to prevent further access

Notify law enforcement before any internal investigation

Change the account password and enable MFA

A company is using a SaaS application for customer relationship management (CRM). The security team wants to implement a control to detect unauthorized access to customer data. Which control is MOST appropriate?

Implement a web application firewall (WAF) for the SaaS application.

Conduct regular vulnerability scans of the SaaS provider's infrastructure.

Deploy a network intrusion detection system (IDS) in front of the SaaS application.

Enable the SaaS application's audit logging and review logs for unusual access patterns.

A security analyst sees a large volume of data being transferred from a cloud storage bucket to an external IP address that is not associated with the company. The bucket contains proprietary source code. Which cloud-specific attack technique is most likely occurring?

Data exfiltration via a cloud service

Resource hijacking to mine cryptocurrency

Account takeover to change permissions

An attacker has compromised a cloud account and is using the cloud provider's services to exfiltrate data. The exfiltration is happening slowly over time to avoid detection. Which detection technique is MOST effective at identifying this activity?

Reviewing firewall logs for blocked traffic.

Anomaly detection on data transfer volumes.

Checking for unauthorized API calls.

Monitoring for failed login attempts.

GIAC Cyber Incident Leader

Domain 1Objective 1

Cloud Attacks GCIL Practice Questions (Page 2)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 6–10

6application · medium
A company uses a cloud-based object storage service to store sensitive customer data. They want to ensure that data is protected both at rest and in transit. Which combination of controls should they implement?
Select an answer first
7expert · hard
A cloud incident response team is investigating a suspected account takeover. The team needs to determine the scope of the attack and preserve evidence. Which of the following is the most important FIRST step?
Select an answer first
8expert · medium
A company is using a SaaS application for customer relationship management (CRM). The security team wants to implement a control to detect unauthorized access to customer data. Which control is MOST appropriate?
Select an answer first
9application · medium
A security analyst sees a large volume of data being transferred from a cloud storage bucket to an external IP address that is not associated with the company. The bucket contains proprietary source code. Which cloud-specific attack technique is most likely occurring?
Select an answer first
10expert · medium
An attacker has compromised a cloud account and is using the cloud provider's services to exfiltrate data. The exfiltration is happening slowly over time to avoid detection. Which detection technique is MOST effective at identifying this activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.