An organization is investigating a potential data breach. They need to determine if sensitive data was transferred from a virtual machine to an external IP address. Which log source would provide the most useful evidence?

Network flow logs showing outbound connections

A security team is implementing a logging strategy for a multi-cloud environment. They need to ensure that logs from different cloud providers can be searched and correlated in one place. Which approach is most effective?

Keep logs in each provider's native logging service and search them separately

Export logs from each provider to a shared cloud storage bucket and use a spreadsheet

Enable logging only in the provider that hosts the most critical workloads

Use a third-party SIEM that ingests logs from all cloud providers

A company is migrating its on-premises applications to the cloud. The security team wants to maintain the same level of logging visibility. Which consideration is most important when planning the cloud logging strategy?

Rely on the cloud provider's default logging settings

Ensure all log sources, including cloud-native services and migrated VMs, are integrated into the logging pipeline

Disable logging for migrated VMs to reduce costs

Use separate logging tools for cloud and on-premises environments

A security operations team is evaluating its logging strategy. They currently collect logs from all systems but do not have a standardized format. Analysts are struggling to correlate events across different sources. Which improvement would have the most immediate impact on correlation efficiency?

Reduce the number of log sources

Implement a log normalization and parsing layer

Increase the log retention period

GIAC Cloud Security Essentials

Domain 6Objective 1

Cloud Logging Fundamentals GCLD Practice Questions (Page 6)

Part of the Logging and Incident Response domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

1concept

Questions 26–30

26application · medium
During an incident response, an analyst needs to determine the exact time an attacker first accessed a sensitive file on a compromised server. Which log type would provide the most direct evidence?
Select an answer first
27application · medium
An organization is investigating a potential data breach. They need to determine if sensitive data was transferred from a virtual machine to an external IP address. Which log source would provide the most useful evidence?
Select an answer first
28application · medium
A security team is implementing a logging strategy for a multi-cloud environment. They need to ensure that logs from different cloud providers can be searched and correlated in one place. Which approach is most effective?
Select an answer first
29application · medium
A company is migrating its on-premises applications to the cloud. The security team wants to maintain the same level of logging visibility. Which consideration is most important when planning the cloud logging strategy?
Select an answer first
30expert · hard
A security operations team is evaluating its logging strategy. They currently collect logs from all systems but do not have a standardized format. Analysts are struggling to correlate events across different sources. Which improvement would have the most immediate impact on correlation efficiency?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.