Network Security Monitoring in the Cloud GCLD Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company runs a production workload in AWS with EC2 instances in a private subnet. The security team needs to capture full packet payloads for east-west traffic between instances for a forensic investigation. They have IAM permissions to modify VPC resources but cannot install agents on the instances. Which approach should they use?

   • ADeploy a third-party agent on each EC2 instance to capture traffic at the hypervisor level.
   • BEnable VPC Traffic Mirroring on the ENIs of the instances and send mirrored traffic to a security appliance in the same VPC.
   • CEnable VPC Flow Logs and stream them to Amazon S3 for payload analysis.
   • DUse AWS Network Firewall to log all traffic to S3 in PCAP format.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team wants to monitor network traffic in a hybrid cloud environment (on-premises and AWS). They need to detect anomalies across both environments. Which approach is most effective?

   • AUse VPC Flow Logs to monitor on-premises traffic by enabling them on the VPN gateway.
   • BDeploy a SIEM that ingests flow logs from AWS and on-premises network devices, and configure correlation rules.
   • CUse AWS CloudWatch to monitor on-premises traffic by sending logs from on-premises firewalls to CloudWatch.
   • DUse AWS Network Firewall to monitor on-premises traffic through a VPN connection.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During an incident response in GCP, an investigator needs to determine which internal VM communicated with an external malicious IP over the past 48 hours. The investigator has access to VPC Flow Logs but the logs are not yet enabled. What is the most practical first step?

   • AUse VPC Flow Logs from the last 48 hours if they were enabled on a different project that peered with this VPC.
   • BCheck if any existing flow logs or other logging sources (e.g., firewall logs, Cloud NAT logs) already captured the traffic.
   • CEnable VPC Flow Logs on the VPC and wait for new logs to accumulate, then query them for the malicious IP.
   • DDeploy a packet capture agent on the VM to retroactively capture the past 48 hours of traffic.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A forensic investigator is analyzing a security incident that occurred two weeks ago. The company has VPC Flow Logs enabled, but they are stored in S3 with a lifecycle policy that deletes logs after 30 days. The investigator needs to determine if a specific IP address communicated with any internal resources. What is the best way to proceed?

   • ARequest the logs from the cloud provider's support team.
   • BUse the instance's system logs to determine network connections.
   • CCheck the VPC console for historical flow log data.
   • DQuery the S3 bucket using Amazon Athena to search for the IP address in the flow logs.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security architect is designing network monitoring for a hybrid cloud environment. The company has strict data residency requirements that prohibit sending certain traffic logs outside the country. They also want to use a third-party SIEM for centralized monitoring. What is the best approach to meet both requirements?

   • ADeploy a SIEM collector in the same cloud region and country to aggregate logs before sending them to the central SIEM.
   • BStore logs in the cloud provider's global logging service and access them from the SIEM.
   • CUse only cloud-native monitoring tools and do not use a third-party SIEM.
   • DEncrypt the logs and send them to the SIEM in another country.
   Reveal Solution Discussion Select an answer first