Network Security Monitoring in the Cloud GCLD Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is responsible for monitoring a multi-account AWS environment. They need to capture full packet payloads for a subset of critical instances for forensic analysis, but they have a limited budget and cannot afford to mirror all traffic. They also need to retain the data for 90 days. Which approach balances cost and forensic capability?

   • AEnable VPC Traffic Mirroring only for the critical instances and send mirrored traffic to a Network Load Balancer fronting a fleet of EC2 instances running Suricata, storing PCAPs in S3 with lifecycle policies for 90-day retention.
   • BEnable VPC Flow Logs for all accounts and store them in S3 with 90-day lifecycle.
   • CMirror all traffic in all accounts to a central collector using a third-party commercial tool.
   • DUse AWS Network Firewall to capture full packets for all traffic and store them in S3.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a key consideration when using network monitoring data for forensic analysis in the cloud?

   • ANetwork monitoring data is not admissible in court
   • BForensic analysis can only be performed by the cloud provider
   • CData may be ephemeral if logging is not enabled before the incident
   • DNetwork data is always stored indefinitely by default
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst notices a large spike in outbound traffic from a single VM to an external IP address. The VM is not expected to make such connections. What is the most immediate step to investigate this potential anomaly?

   • AReview the VPC Flow Logs for the VM to identify the destination IP and port.
   • BIncrease the VM's instance size to handle the traffic.
   • CDisable the VM's public IP address immediately.
   • DCheck the VM's CPU utilization in CloudWatch.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst is investigating a suspected data exfiltration from an Azure VM. The VM is in a VNet with NSG flow logs enabled. Which data source would provide the most useful information to trace the exfiltration path?

   • AAzure Security Center recommendations for the VM.
   • BAzure Activity Log showing who started the VM.
   • CAzure Monitor metrics for CPU and memory usage.
   • DNSG flow logs showing source and destination IPs, ports, and byte counts for each connection.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is responsible for monitoring a multi-cloud environment (AWS and Azure). They need to ensure that network monitoring data is available for forensic investigations for at least one year. They have a limited budget. Which approach is most cost-effective?

   • AStore all flow logs in a SIEM for one year.
   • BEnable VPC Flow Logs and NSG Flow Logs, and export them to S3 and Azure Blob Storage respectively, with lifecycle policies to transition to cold storage after 30 days.
   • CUse only CloudWatch and Azure Monitor to retain logs for one year.
   • DEnable VPC Traffic Mirroring for all instances and store PCAPs in S3.
   Reveal Solution Discussion Select an answer first