A security analyst notices a sudden spike in outbound traffic from an Azure VM to an external IP address known to be a command-and-control server. The VM is part of a VNet with NSG flow logs enabled and Azure Sentinel connected. Which action would provide the most immediate and actionable alerting for this type of activity?

Enable Azure Network Watcher packet capture on the VM's NIC to record all traffic to the external IP.

Create a custom analytics rule in Azure Sentinel that triggers when NSG flow logs show repeated connections to the known malicious IP.

Configure a diagnostic setting to stream NSG flow logs to a storage account for later analysis.

Use Azure Monitor alerts on the VM's CPU utilization to detect the anomaly.

In the shared responsibility model, which layer of network monitoring is typically the responsibility of the cloud customer?

Monitoring the provider's backbone network between regions

Monitoring the physical security of the data center hosting the cloud resources

Monitoring the physical network infrastructure, such as fiber optic cables and switches

Monitoring the virtual network components and traffic within their own virtual private cloud (VPC)

A company is moving a critical application to the cloud and needs to ensure that network traffic between application tiers can be inspected for malware. The application uses multiple VMs in the same VPC. Which method would provide the most comprehensive inspection of the traffic?

Enable VPC Flow Logs and analyze them for anomalies.

Deploy a cloud-native intrusion detection system (IDS) that uses packet mirroring to inspect traffic.

Install a host-based firewall on each VM to log connections.

Use security groups and network ACLs to restrict traffic between tiers.

A SOC team is evaluating monitoring tools for a cloud environment that uses both AWS and Azure. They need to detect anomalies across both clouds and have a limited budget. They already have a SIEM that can ingest logs from both providers. What is the most cost-effective approach to enhance their network monitoring?

Use only open-source tools and do not use the SIEM.

Deploy a dedicated network monitoring appliance in each cloud.

Enable native flow logs in both clouds and send them to the existing SIEM.

Purchase a commercial cloud security posture management (CSPM) tool that includes network monitoring.

GIAC Cloud Security Essentials

Domain 2Objective 3

Network Security Monitoring in the Cloud GCLD Practice Questions (Page 6)

Part of the Cloud Networking and Security domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 26–30

26application · medium
A security analyst notices a sudden spike in outbound traffic from an Azure VM to an external IP address known to be a command-and-control server. The VM is part of a VNet with NSG flow logs enabled and Azure Sentinel connected. Which action would provide the most immediate and actionable alerting for this type of activity?
Select an answer first
27foundation · easy
In the shared responsibility model, which layer of network monitoring is typically the responsibility of the cloud customer?
Select an answer first
28application · medium
A company is moving a critical application to the cloud and needs to ensure that network traffic between application tiers can be inspected for malware. The application uses multiple VMs in the same VPC. Which method would provide the most comprehensive inspection of the traffic?
Select an answer first
29expert · hard
A SOC team is evaluating monitoring tools for a cloud environment that uses both AWS and Azure. They need to detect anomalies across both clouds and have a limited budget. They already have a SIEM that can ingest logs from both providers. What is the most cost-effective approach to enhance their network monitoring?
Select an answer first
30foundation · easy
A security team needs to perform deep packet inspection on traffic to and from a specific cloud VM to detect malware signatures. Which method is most appropriate for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Network Security Monitoring in the Cloud GCLD Practice Questions (Page 6)

Questions 26–30

In the shared responsibility model, which layer of network monitoring is typically the responsibility of the cloud customer?

A company is moving a critical application to the cloud and needs to ensure that network traffic between application tiers can be inspected for malware. The application uses multiple VMs in the same VPC. Which method would provide the most comprehensive inspection of the traffic?

A security team needs to perform deep packet inspection on traffic to and from a specific cloud VM to detect malware signatures. Which method is most appropriate for this task?

Keep studying — Cloud Networking and Security