A security analyst notices that a cloud workload's outbound traffic to a known file-sharing domain has increased 20x over the past hour. The workload is a web application that normally only calls its database and an internal authentication service. The analyst checks the cloud provider's VPC flow logs and sees the traffic originates from a single application server. Which action should the analyst take FIRST to determine whether this is an intrusion?

Reset the credentials of the service account used by the application server.

Block the file-sharing domain at the network firewall to stop the exfiltration immediately.

Disable the application server's outbound internet access to prevent further data loss.

Review the application server's OS and application logs for signs of compromise, such as unusual processes or scheduled tasks.

Which of the following is a common indicator of a cloud account compromise?

A scheduled maintenance window being announced

Unexpected changes to access keys or permissions

A user logging in from their usual office IP address

An increase in the number of virtual machines in the environment

When conducting a forensic investigation in a cloud environment, which of the following is a critical first step to preserve evidence?

Installing forensic tools on the running VM

Taking a snapshot of the virtual machine's disk

Deleting the virtual machine to prevent further compromise

Rebooting the virtual machine to clear memory

A security team wants to detect potential data exfiltration from an Azure Storage account. They need to capture both successful and failed read operations on blobs, including the source IP and user identity. Which configuration should they implement?

Enable diagnostic settings for the storage account and send the StorageRead logs to a Log Analytics workspace

Enable Azure Defender for Storage and rely on its built-in alerts

Enable Azure Activity Log and send it to a Log Analytics workspace

Enable network security group flow logs on the subnet hosting the storage account

GIAC Cloud Security Essentials

Domain 6Objective 2

Attacking the Cloud and Responding to Intrusions GCLD Practice Questions (Page 5)

Part of the Logging and Incident Response domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 21–25

21application · medium
A security analyst notices that a cloud workload's outbound traffic to a known file-sharing domain has increased 20x over the past hour. The workload is a web application that normally only calls its database and an internal authentication service. The analyst checks the cloud provider's VPC flow logs and sees the traffic originates from a single application server. Which action should the analyst take FIRST to determine whether this is an intrusion?
Select an answer first
22foundation · easy
Which of the following is a common indicator of a cloud account compromise?
Select an answer first
23application · medium
A developer accidentally exposed an API key in a public GitHub repository. Within hours, the security team notices unusual activity using that API key to access cloud resources. Which of the following is the MOST likely attack vector?
Select an answer first
24foundation · easy
When conducting a forensic investigation in a cloud environment, which of the following is a critical first step to preserve evidence?
Select an answer first
25application · medium
A security team wants to detect potential data exfiltration from an Azure Storage account. They need to capture both successful and failed read operations on blobs, including the source IP and user identity. Which configuration should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Attacking the Cloud and Responding to Intrusions GCLD Practice Questions (Page 5)

Questions 21–25

Which of the following is a common indicator of a cloud account compromise?

A developer accidentally exposed an API key in a public GitHub repository. Within hours, the security team notices unusual activity using that API key to access cloud resources. Which of the following is the MOST likely attack vector?

When conducting a forensic investigation in a cloud environment, which of the following is a critical first step to preserve evidence?

A security team wants to detect potential data exfiltration from an Azure Storage account. They need to capture both successful and failed read operations on blobs, including the source IP and user identity. Which configuration should they implement?

Keep studying — Logging and Incident Response