A security engineer needs to capture network traffic for a compliance audit. The requirement is to capture all traffic between two specific VMs, but the cloud provider charges for packet mirroring based on the amount of traffic mirrored. The budget is limited. What is the most cost-effective way to meet the requirement?

Enable VPC Flow Logs instead of packet mirroring.

Use an agent-based capture tool on both VMs.

Mirror all traffic in the subnet to ensure nothing is missed.

Enable packet mirroring only for the specific ENIs of the two VMs.

A security analyst is setting up network monitoring for a new cloud environment. The team wants to ensure they can detect malicious activity that occurs entirely within the virtual network, such as lateral movement between VMs. Which combination of monitoring methods would provide the most complete visibility?

Use only cloud provider native monitoring tools like CloudWatch or Azure Monitor.

Enable flow logs only for the internet-facing subnet.

Deploy a network virtual appliance (NVA) in a single subnet and route all traffic through it.

Enable flow logs for all subnets and deploy an agent-based IDS on each VM.

A company runs a Kubernetes cluster on GCP. They need to monitor network traffic between pods for anomaly detection. Which method is most appropriate?

Use GCP Packet Mirroring to mirror traffic from all pod ENIs.

Enable VPC Flow Logs on the cluster's VPC to capture pod-to-pod traffic.

Use Google Cloud Armor to log all traffic to the cluster.

Deploy a DaemonSet with an agent that captures pod-level traffic using eBPF or similar technology.

A security team wants to implement network monitoring for a serverless application on AWS Lambda. They need to detect anomalous outbound traffic from Lambda functions. Which approach is most feasible?

Use AWS Network Firewall to monitor traffic from Lambda functions.

Use AWS CloudTrail to monitor network traffic from Lambda functions.

Deploy an agent inside the Lambda function to capture traffic.

Enable VPC Flow Logs for the VPC where the Lambda functions are configured to run.

Which of the following is a native cloud service that can be used to monitor network traffic and is often integrated with a SIEM for security analysis?

A custom Python script running on a laptop

A third-party intrusion prevention system (IPS) installed on a VM

GIAC Cloud Security Essentials

Domain 2Objective 3

Network Security Monitoring in the Cloud GCLD Practice Questions (Page 4)

Part of the Cloud Networking and Security domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 16–20

16expert · hard
A security engineer needs to capture network traffic for a compliance audit. The requirement is to capture all traffic between two specific VMs, but the cloud provider charges for packet mirroring based on the amount of traffic mirrored. The budget is limited. What is the most cost-effective way to meet the requirement?
Select an answer first
17application · medium
A security analyst is setting up network monitoring for a new cloud environment. The team wants to ensure they can detect malicious activity that occurs entirely within the virtual network, such as lateral movement between VMs. Which combination of monitoring methods would provide the most complete visibility?
Select an answer first
18application · medium
A company runs a Kubernetes cluster on GCP. They need to monitor network traffic between pods for anomaly detection. Which method is most appropriate?
Select an answer first
19expert · hard
A security team wants to implement network monitoring for a serverless application on AWS Lambda. They need to detect anomalous outbound traffic from Lambda functions. Which approach is most feasible?
Select an answer first
20foundation · easy
Which of the following is a native cloud service that can be used to monitor network traffic and is often integrated with a SIEM for security analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Network Security Monitoring in the Cloud GCLD Practice Questions (Page 4)

Questions 16–20

A company runs a Kubernetes cluster on GCP. They need to monitor network traffic between pods for anomaly detection. Which method is most appropriate?

A security team wants to implement network monitoring for a serverless application on AWS Lambda. They need to detect anomalous outbound traffic from Lambda functions. Which approach is most feasible?

Which of the following is a native cloud service that can be used to monitor network traffic and is often integrated with a SIEM for security analysis?

Keep studying — Cloud Networking and Security