Which of the following is a common method used by attackers to exfiltrate data from a cloud environment?

Transferring data to an external storage service

Changing the data's storage class

Deleting the data from the cloud

A company has experienced a security incident where an attacker gained access to a cloud management console and created a new admin user. The security team has identified the attacker's actions in the audit logs. Which of the following is the MOST appropriate containment step?

Delete the admin user that the attacker created.

Change the password of the compromised admin user.

Take a snapshot of the management console's configuration.

Disable the compromised admin user and revoke all active sessions.

A security analyst is reviewing Azure Active Directory sign-in logs and notices a successful sign-in from an unfamiliar IP address in a foreign country at 3:00 AM local time. The user has MFA enabled. Which of the following should the analyst do to determine if this is a compromised account?

Check if the sign-in was flagged as a risk by Azure AD Identity Protection.

Immediately disable the user's account.

Ignore the sign-in because MFA was satisfied.

GIAC Cloud Security Essentials

Domain 6Objective 2

Attacking the Cloud and Responding to Intrusions GCLD Practice Questions (Page 2)

Part of the Logging and Incident Response domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 6–10

6foundation · easy
Which of the following is a common method used by attackers to exfiltrate data from a cloud environment?
Select an answer first
7foundation · easy
Which of the following is a common cloud-specific attack vector that results from a failure to restrict access to a cloud storage bucket?
Select an answer first
8expert · medium
A company has experienced a security incident where an attacker gained access to a cloud management console and created a new admin user. The security team has identified the attacker's actions in the audit logs. Which of the following is the MOST appropriate containment step?
Select an answer first
9application · medium
A security analyst is reviewing Azure Active Directory sign-in logs and notices a successful sign-in from an unfamiliar IP address in a foreign country at 3:00 AM local time. The user has MFA enabled. Which of the following should the analyst do to determine if this is a compromised account?
Select an answer first
10foundation · easy
Which cloud log source is most directly used to detect a brute-force attack against a cloud management console?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Attacking the Cloud and Responding to Intrusions GCLD Practice Questions (Page 2)

Questions 6–10

Which of the following is a common method used by attackers to exfiltrate data from a cloud environment?

Which of the following is a common cloud-specific attack vector that results from a failure to restrict access to a cloud storage bucket?

A company has experienced a security incident where an attacker gained access to a cloud management console and created a new admin user. The security team has identified the attacker's actions in the audit logs. Which of the following is the MOST appropriate containment step?

A security analyst is reviewing Azure Active Directory sign-in logs and notices a successful sign-in from an unfamiliar IP address in a foreign country at 3:00 AM local time. The user has MFA enabled. Which of the following should the analyst do to determine if this is a compromised account?

Which cloud log source is most directly used to detect a brute-force attack against a cloud management console?

Keep studying — Logging and Incident Response