A security analyst is configuring anomaly detection for a cloud environment. They want to detect data exfiltration, which often involves large volumes of outbound traffic. They have VPC Flow Logs enabled and a SIEM. Which detection strategy would be most effective while minimizing false positives?

Alert on all outbound traffic during non-business hours.

Use a threat intelligence feed to alert on known malicious IPs.

Create a baseline of normal outbound traffic volumes and alert on significant deviations.

Alert on any outbound traffic to a new destination IP.

During an incident response in Azure, an analyst needs to determine if a compromised VM communicated with a specific external IP. The VM was deleted after the incident. Which data source would provide the most reliable evidence?

NSG flow logs that were enabled before the VM was deleted and stored in a Log Analytics workspace.

Azure Activity Logs showing the VM deletion event.

Network Watcher packet capture files stored on the VM's disk.

Azure Monitor metrics for the VM that were collected before deletion.

Which statement best describes a key challenge for network security monitoring in a cloud environment compared to a traditional on-premises data center?

Cloud providers prohibit all forms of network monitoring to protect multi-tenant privacy.

Customers must deploy their own physical network taps inside the provider's data center to capture traffic.

The cloud provider controls the physical network infrastructure, so the customer cannot directly capture packets at the hypervisor level without using provider-supported tools.

Network traffic in the cloud is encrypted by default, making all monitoring impossible without decrypting every packet.

After a security incident, a forensic team needs to reconstruct the sequence of network connections made by a compromised instance. They have VPC Flow Logs enabled and stored in S3. What is the best way to analyze the logs to determine the full attack timeline?

Use Amazon Athena to query the flow logs and sort by start time.

Enable AWS X-Ray to trace the network connections.

Download all flow logs and open them in a spreadsheet.

Use the VPC console to view the flow logs for the instance.

During an incident response in AWS, an analyst needs to determine if a compromised EC2 instance exfiltrated data to an external IP. The instance is still running. Which combination of data sources would provide the most complete evidence?

VPC Flow Logs and AWS Trusted Advisor reports.

CloudTrail logs and AWS Health Dashboard events.

AWS Config rules showing security group changes and CloudWatch metrics for CPU.

VPC Flow Logs for the instance's ENI and CloudTrail logs for any API calls made by the instance.

GIAC Cloud Security Essentials

Domain 2Objective 3

Network Security Monitoring in the Cloud GCLD Practice Questions (Page 2)

Part of the Cloud Networking and Security domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 6–10

6expert · hard
A security analyst is configuring anomaly detection for a cloud environment. They want to detect data exfiltration, which often involves large volumes of outbound traffic. They have VPC Flow Logs enabled and a SIEM. Which detection strategy would be most effective while minimizing false positives?
Select an answer first
7expert · hard
During an incident response in Azure, an analyst needs to determine if a compromised VM communicated with a specific external IP. The VM was deleted after the incident. Which data source would provide the most reliable evidence?
Select an answer first
8foundation · easy
Which statement best describes a key challenge for network security monitoring in a cloud environment compared to a traditional on-premises data center?
Select an answer first
9application · medium
After a security incident, a forensic team needs to reconstruct the sequence of network connections made by a compromised instance. They have VPC Flow Logs enabled and stored in S3. What is the best way to analyze the logs to determine the full attack timeline?
Select an answer first
10expert · hard
During an incident response in AWS, an analyst needs to determine if a compromised EC2 instance exfiltrated data to an external IP. The instance is still running. Which combination of data sources would provide the most complete evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.