A security team is designing a logging strategy for a multi-cloud environment (AWS and Azure). They need to detect and respond to security incidents across both clouds. Which of the following is the BEST approach?

Use a centralized SIEM that ingests logs from both AWS CloudTrail and Azure Activity Logs.

Use only AWS CloudTrail and Azure Activity Logs without a SIEM.

Use a third-party logging tool that only supports AWS.

Use separate logging tools for each cloud and review them independently.

A cloud administrator discovers that a former employee's service account is still active and has been used to download a large volume of data from a cloud database. The employee left the company two weeks ago. Which action should be taken first to stop the data exfiltration?

Take a snapshot of the database for forensic analysis

Disable the service account and revoke its access keys

Change the database password and notify the former employee

Review the database audit logs to determine the scope of the download

A company uses a public cloud provider and has a web application that calls an internal API. The API key is stored in the application's source code repository. An attacker gains access to the repository and uses the API key to make unauthorized calls. Which additional control would have most effectively prevented this attack?

Using a longer and more complex API key

Storing the API key in a cloud secrets manager and referencing it at runtime

Adding the API key to the application's configuration file

Encrypting the source code repository

Which of the following is a primary purpose of enabling detailed logging for cloud resources?

To reduce the cost of cloud services

To automatically patch vulnerabilities

To provide an audit trail for security investigations

To increase the performance of the cloud resources

GIAC Cloud Security Essentials

Domain 6Objective 2

Attacking the Cloud and Responding to Intrusions GCLD Practice Questions (Page 1)

Part of the Logging and Incident Response domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 1–5

1expert · medium
A security team is designing a logging strategy for a multi-cloud environment (AWS and Azure). They need to detect and respond to security incidents across both clouds. Which of the following is the BEST approach?
Select an answer first
2application · medium
A cloud administrator discovers that a former employee's service account is still active and has been used to download a large volume of data from a cloud database. The employee left the company two weeks ago. Which action should be taken first to stop the data exfiltration?
Select an answer first
3application · medium
A cloud security team wants to detect anomalous behavior in their AWS environment, such as unusual API calls or network traffic. They have enabled CloudTrail and VPC Flow Logs, but they need a centralized solution to analyze the logs in real time. Which of the following should they implement?
Select an answer first
4application · medium
A company uses a public cloud provider and has a web application that calls an internal API. The API key is stored in the application's source code repository. An attacker gains access to the repository and uses the API key to make unauthorized calls. Which additional control would have most effectively prevented this attack?
Select an answer first
5foundation · easy
Which of the following is a primary purpose of enabling detailed logging for cloud resources?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Attacking the Cloud and Responding to Intrusions GCLD Practice Questions (Page 1)

Questions 1–5

A security team is designing a logging strategy for a multi-cloud environment (AWS and Azure). They need to detect and respond to security incidents across both clouds. Which of the following is the BEST approach?

A cloud administrator discovers that a former employee's service account is still active and has been used to download a large volume of data from a cloud database. The employee left the company two weeks ago. Which action should be taken first to stop the data exfiltration?

A cloud security team wants to detect anomalous behavior in their AWS environment, such as unusual API calls or network traffic. They have enabled CloudTrail and VPC Flow Logs, but they need a centralized solution to analyze the logs in real time. Which of the following should they implement?

Which of the following is a primary purpose of enabling detailed logging for cloud resources?

Keep studying — Logging and Incident Response