A company is migrating from on-premises to the cloud. They need to maintain the same level of logging for their applications. Which consideration is most important when designing the cloud logging strategy?

Reducing the volume of logs to save costs

Using the cloud provider's native logging service exclusively

Storing logs only in the cloud provider's storage

Ensuring that application logs are forwarded to a centralized location that supports the same analysis tools

During an incident, an analyst needs to determine whether an attacker exfiltrated data from a cloud storage bucket. Which log source would provide the most direct evidence of data access and retrieval?

Configuration change logs for the storage account

Data access logs for the storage bucket

Network flow logs for the virtual network

Authentication logs for the cloud console

GIAC Cloud Security Essentials

Domain 6Objective 1

Cloud Logging Fundamentals GCLD Practice Questions (Page 5)

Part of the Logging and Incident Response domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

1concept

Questions 21–25

21application · medium
An incident responder is examining a suspected privilege escalation. The responder needs to see which user accounts were created or modified around the time of the incident. Which log type should be reviewed first?
Select an answer first
22expert · hard
A company is migrating from on-premises to the cloud. They need to maintain the same level of logging for their applications. Which consideration is most important when designing the cloud logging strategy?
Select an answer first
23application · medium
During an incident, an analyst needs to determine whether an attacker exfiltrated data from a cloud storage bucket. Which log source would provide the most direct evidence of data access and retrieval?
Select an answer first
24application · medium
A cloud administrator is configuring logging for a new application. The compliance team requires that all security-relevant events be retained for at least one year. Which logging component is primarily responsible for meeting this retention requirement?
Select an answer first
25application · medium
A security operations center (SOC) analyst is reviewing logs to detect a potential data exfiltration. The analyst has access to application logs, firewall logs, and cloud API audit logs. Which log source would most likely reveal the transfer of a large volume of data to an external IP address?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Cloud Logging Fundamentals GCLD Practice Questions (Page 5)

Questions 21–25

An incident responder is examining a suspected privilege escalation. The responder needs to see which user accounts were created or modified around the time of the incident. Which log type should be reviewed first?

A company is migrating from on-premises to the cloud. They need to maintain the same level of logging for their applications. Which consideration is most important when designing the cloud logging strategy?

During an incident, an analyst needs to determine whether an attacker exfiltrated data from a cloud storage bucket. Which log source would provide the most direct evidence of data access and retrieval?

A cloud administrator is configuring logging for a new application. The compliance team requires that all security-relevant events be retained for at least one year. Which logging component is primarily responsible for meeting this retention requirement?

A security operations center (SOC) analyst is reviewing logs to detect a potential data exfiltration. The analyst has access to application logs, firewall logs, and cloud API audit logs. Which log source would most likely reveal the transfer of a large volume of data to an external IP address?

Keep studying — Logging and Incident Response