A security analyst is reviewing Azure activity logs and notices that a virtual machine was created in a region where the company has no presence. The VM was created using a service principal that has contributor permissions. Which of the following is the MOST likely indicator of a compromised service principal?

The service principal has contributor permissions.

The VM was created with a public IP address.

The VM was created using a standard image.

The VM creation occurred outside business hours and in an unusual region.

A forensic investigator is examining a compromised container in a Kubernetes cluster. The container has already been terminated, but the investigator needs to analyze the container's filesystem and runtime environment. Which of the following is the BEST source of evidence?

The container image and any persistent volume snapshots.

The Kubernetes API server logs.

A company stores customer data in an Amazon S3 bucket. A security review reveals that the bucket policy allows 's3:GetObject' to 'Principal: *' and the bucket is not configured to block public access. An analyst discovers that a third party has been downloading the data. Which of the following is the MOST likely attack vector that was exploited?

Misconfigured storage permissions

Which cloud service is specifically designed to collect and analyze security-related logs from various cloud resources?

Security information and event management (SIEM)

GIAC Cloud Security Essentials

Domain 6Objective 2

Attacking the Cloud and Responding to Intrusions GCLD Practice Questions (Page 6)

Part of the Logging and Incident Response domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 26–30

26application · medium
A security analyst is reviewing Azure activity logs and notices that a virtual machine was created in a region where the company has no presence. The VM was created using a service principal that has contributor permissions. Which of the following is the MOST likely indicator of a compromised service principal?
Select an answer first
27application · medium
A forensic investigator is examining a compromised container in a Kubernetes cluster. The container has already been terminated, but the investigator needs to analyze the container's filesystem and runtime environment. Which of the following is the BEST source of evidence?
Select an answer first
28foundation · easy
In cloud incident response, which step is primarily focused on preventing the attacker from continuing to access the compromised resource?
Select an answer first
29application · medium
A company stores customer data in an Amazon S3 bucket. A security review reveals that the bucket policy allows 's3:GetObject' to 'Principal: *' and the bucket is not configured to block public access. An analyst discovers that a third party has been downloading the data. Which of the following is the MOST likely attack vector that was exploited?
Select an answer first
30foundation · easy
Which cloud service is specifically designed to collect and analyze security-related logs from various cloud resources?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Attacking the Cloud and Responding to Intrusions GCLD Practice Questions (Page 6)

Questions 26–30

A forensic investigator is examining a compromised container in a Kubernetes cluster. The container has already been terminated, but the investigator needs to analyze the container's filesystem and runtime environment. Which of the following is the BEST source of evidence?

In cloud incident response, which step is primarily focused on preventing the attacker from continuing to access the compromised resource?

Which cloud service is specifically designed to collect and analyze security-related logs from various cloud resources?

Keep studying — Logging and Incident Response