A security team wants to centralize network monitoring for a multi-cloud environment (AWS, Azure, and GCP). They need a single pane of glass for alerting and investigation. Which approach best meets this requirement?

Use a cloud-agnostic packet capture tool that captures traffic from all clouds simultaneously.

Use AWS CloudWatch, Azure Monitor, and Google Cloud Monitoring separately and manually correlate alerts.

Use a third-party SIEM that ingests VPC Flow Logs, NSG Flow Logs, and VPC Flow Logs from all clouds.

Use a single cloud provider's native monitoring tool to monitor all other clouds.

A security team needs to capture network traffic for a forensic investigation, but the cloud provider does not support packet mirroring in the region where the workload runs. The team has access to the virtual machines and can install software. What is the best alternative to capture the required traffic?

Enable flow logs and use them as a substitute for packet capture.

Rely on the cloud provider's support team to capture packets.

Use a third-party network virtual appliance that is deployed in a different region.

Install an agent-based packet capture tool on the virtual machines to capture traffic locally.

A security analyst needs to capture full packet payloads for a forensic investigation of a suspected compromise inside a VPC. The investigation requires seeing the actual contents of the traffic between two specific EC2 instances, not just connection metadata. Which approach will provide the needed data with the least operational overhead?

Use AWS Trusted Advisor to review network access logs for the instances.

Install the CloudWatch agent on both instances to collect network metrics.

Enable VPC Flow Logs on the subnets and export them to Amazon S3.

Configure traffic mirroring on the Elastic Network Interfaces of the two instances and send mirrored traffic to a security appliance.

A security team is investigating a potential data breach in a GCP project. They need to determine if any VM communicated with a known malicious IP in the last 30 days. VPC Flow Logs are enabled, but the logs are only retained for 7 days. What is the best course of action?

Enable VPC Flow Logs now and wait for 30 days to collect new data.

Use GCP's packet mirroring to retroactively capture past traffic.

Use Cloud Armor logs to determine past traffic.

Check if the flow logs were exported to BigQuery or Cloud Storage for longer retention.

GIAC Cloud Security Essentials

Domain 2Objective 3

Network Security Monitoring in the Cloud GCLD Practice Questions (Page 1)

Part of the Cloud Networking and Security domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 1–5

1application · medium
A security team wants to centralize network monitoring for a multi-cloud environment (AWS, Azure, and GCP). They need a single pane of glass for alerting and investigation. Which approach best meets this requirement?
Select an answer first
2expert · hard
A security team needs to capture network traffic for a forensic investigation, but the cloud provider does not support packet mirroring in the region where the workload runs. The team has access to the virtual machines and can install software. What is the best alternative to capture the required traffic?
Select an answer first
3application · medium
A security analyst needs to capture full packet payloads for a forensic investigation of a suspected compromise inside a VPC. The investigation requires seeing the actual contents of the traffic between two specific EC2 instances, not just connection metadata. Which approach will provide the needed data with the least operational overhead?
Select an answer first
4expert · hard
A security team is investigating a potential data breach in a GCP project. They need to determine if any VM communicated with a known malicious IP in the last 30 days. VPC Flow Logs are enabled, but the logs are only retained for 7 days. What is the best course of action?
Select an answer first
5foundation · easy
Which cloud-native feature provides metadata about network traffic flows (e.g., source IP, destination IP, port, and action) but does NOT capture the actual packet payloads?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Network Security Monitoring in the Cloud GCLD Practice Questions (Page 1)

Questions 1–5

A security team wants to centralize network monitoring for a multi-cloud environment (AWS, Azure, and GCP). They need a single pane of glass for alerting and investigation. Which approach best meets this requirement?

A security team is investigating a potential data breach in a GCP project. They need to determine if any VM communicated with a known malicious IP in the last 30 days. VPC Flow Logs are enabled, but the logs are only retained for 7 days. What is the best course of action?

Which cloud-native feature provides metadata about network traffic flows (e.g., source IP, destination IP, port, and action) but does NOT capture the actual packet payloads?

Keep studying — Cloud Networking and Security