An attacker gains access to a cloud environment and uses the cloud provider's email service to send phishing emails to internal employees. This is an example of which type of cloud-specific attack?

Data exfiltration via cloud services.

Abuse of cloud services for malicious purposes.

A startup uses a cloud object storage bucket to host a public website. After a security review, the CISO asks you to ensure that only the website's static assets are publicly readable, while all other objects in the same bucket remain private. What is the most appropriate control to implement?

Make the entire bucket public and rely on object-level ACLs to restrict sensitive objects.

Create a bucket policy that grants s3:GetObject to 'Principal': '*' only for objects with a specific prefix used by the website.

Enable default encryption on the bucket and set a bucket policy allowing public read for all objects.

Use a pre-signed URL for every website asset and embed them in the HTML.

A company's cloud environment has a mix of IaaS, PaaS, and SaaS services. The security team is overwhelmed by the number of alerts from different services. They want to implement a unified monitoring solution. Which approach is MOST effective?

Monitor each service independently using its native monitoring tools.

Aggregate logs from all cloud services into a centralized SIEM platform.

Use a third-party tool that only monitors IaaS resources.

Enable logging only for the most critical services.

A company discovers that a cloud storage bucket containing sensitive customer data is publicly readable. The bucket was created by a developer for testing and left with default permissions. Which of the following is the most immediate and appropriate response?

Change the bucket's access policy to private and review access logs for any unauthorized access

Enable encryption on the bucket to protect the data

Notify the data protection authority before taking any action

Delete the bucket immediately to prevent further exposure

GIAC Cyber Incident Leader

Domain 1Objective 1

Cloud Attacks GCIL Practice Questions (Page 5)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 21–25

21foundation · easy
Which cloud service model typically gives the customer the least control over the underlying infrastructure and therefore the least responsibility for securing it?
Select an answer first
22application · medium
An attacker gains access to a cloud environment and uses the cloud provider's email service to send phishing emails to internal employees. This is an example of which type of cloud-specific attack?
Select an answer first
23application · medium
A startup uses a cloud object storage bucket to host a public website. After a security review, the CISO asks you to ensure that only the website's static assets are publicly readable, while all other objects in the same bucket remain private. What is the most appropriate control to implement?
Select an answer first
24expert · medium
A company's cloud environment has a mix of IaaS, PaaS, and SaaS services. The security team is overwhelmed by the number of alerts from different services. They want to implement a unified monitoring solution. Which approach is MOST effective?
Select an answer first
25application · medium
A company discovers that a cloud storage bucket containing sensitive customer data is publicly readable. The bucket was created by a developer for testing and left with default permissions. Which of the following is the most immediate and appropriate response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.