A company suspects that a disgruntled employee has exfiltrated sensitive data from a cloud storage service using their own credentials. The security team has confirmed the employee's account was used to download a large volume of data. Which of the following is the MOST appropriate immediate response?

Contact law enforcement and provide them with the employee's details.

Conduct a forensic analysis of the employee's device to gather evidence.

Disable the employee's account and revoke all active sessions.

Change the employee's password and require multi-factor authentication.

A company's cloud environment has been compromised, and the attacker has exfiltrated data by uploading it to a public cloud storage service. The security team has identified the source of the exfiltration as a compromised EC2 instance. Which of the following is the MOST effective way to stop the exfiltration while preserving evidence?

Detach the EC2 instance's IAM role and apply a network ACL that blocks outbound traffic to the storage service.

Take a snapshot of the EC2 instance and then terminate it.

Terminate the EC2 instance immediately.

Change the storage service's bucket policy to deny all access.

GIAC Cloud Security Essentials

Domain 6Objective 2

Attacking the Cloud and Responding to Intrusions GCLD Practice Questions (Page 3)

Part of the Logging and Incident Response domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 11–15

11foundation · easy
Which of the following is a common attack vector that targets cloud APIs by exploiting weak authentication or excessive permissions?
Select an answer first
12expert · medium
A security team is reviewing their cloud environment for potential attack vectors. They find that a web application's API endpoint is publicly accessible and does not require authentication. The API returns sensitive data. Which of the following is the MOST likely attack vector?
Select an answer first
13foundation · easy
After a cloud incident has been contained, which incident response step involves removing the attacker's persistence mechanisms and malicious files from the environment?
Select an answer first
14application · medium
A company suspects that a disgruntled employee has exfiltrated sensitive data from a cloud storage service using their own credentials. The security team has confirmed the employee's account was used to download a large volume of data. Which of the following is the MOST appropriate immediate response?
Select an answer first
15application · medium
A company's cloud environment has been compromised, and the attacker has exfiltrated data by uploading it to a public cloud storage service. The security team has identified the source of the exfiltration as a compromised EC2 instance. Which of the following is the MOST effective way to stop the exfiltration while preserving evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Attacking the Cloud and Responding to Intrusions GCLD Practice Questions (Page 3)

Questions 11–15

Which of the following is a common attack vector that targets cloud APIs by exploiting weak authentication or excessive permissions?

A security team is reviewing their cloud environment for potential attack vectors. They find that a web application's API endpoint is publicly accessible and does not require authentication. The API returns sensitive data. Which of the following is the MOST likely attack vector?

After a cloud incident has been contained, which incident response step involves removing the attacker's persistence mechanisms and malicious files from the environment?

Keep studying — Logging and Incident Response