During an incident, a cloud forensics investigator needs to preserve evidence from a compromised virtual machine that is still running. The VM is critical to the business and cannot be stopped immediately. Which of the following actions should the investigator take FIRST?

Isolate the VM by removing its public IP address

Collect memory from the VM using a cloud provider's memory dump feature

Power off the VM to prevent further changes

Create a snapshot of the VM's disk

A security analyst is reviewing cloud attack vectors. Which of the following is a common cloud-specific attack vector that often results from weak or absent access policies?

SQL injection in a legacy on-premises database

ARP spoofing on a local network segment

Physical theft of a server from a data center

Which security control is most directly effective in mitigating the risk of compromised credentials in a cloud environment?

Multi-factor authentication (MFA)

In the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?

Network infrastructure maintenance

Physical security of the data center

Patching the guest operating system

GIAC Cyber Incident Leader

Domain 1Objective 1

Cloud Attacks GCIL Practice Questions (Page 7)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 31–35

31expert · hard
During an incident, a cloud forensics investigator needs to preserve evidence from a compromised virtual machine that is still running. The VM is critical to the business and cannot be stopped immediately. Which of the following actions should the investigator take FIRST?
Select an answer first
32foundation · easy
A security analyst is reviewing cloud attack vectors. Which of the following is a common cloud-specific attack vector that often results from weak or absent access policies?
Select an answer first
33foundation · easy
Which security control is most directly effective in mitigating the risk of compromised credentials in a cloud environment?
Select an answer first
34foundation · easy
An attacker gains access to a cloud account and uses the compute resources to mine cryptocurrency. Which cloud-specific attack technique does this describe?
Select an answer first
35foundation · easy
In the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.