A security team is planning to implement network monitoring in a new cloud environment. They are concerned about the shared responsibility model and want to ensure they have visibility into all layers of the network stack. Which approach best addresses this concern?

Enable all available native monitoring services and supplement with agent-based tools on workloads.

Use only agent-based monitoring on all VMs.

Deploy a third-party monitoring tool that only monitors the virtual network.

Rely solely on the cloud provider's monitoring services.

During an incident response, a forensic investigator needs to determine which internal hosts communicated with a known malicious external IP over the past 30 days. The company uses AWS and has VPC Flow Logs enabled. What is the most efficient way to obtain this information?

Enable AWS Shield Advanced to get a report of all traffic to the malicious IP.

Manually review the CloudWatch Logs console for each VPC.

Query the VPC Flow Logs stored in Amazon S3 using Amazon Athena.

Use the AWS Management Console to download all flow logs and search them locally.

A company uses Azure and wants to detect data exfiltration attempts from a VM to an external IP. They have NSG flow logs enabled and Azure Sentinel. Which configuration would best detect this?

Use Azure Monitor to alert on the VM's disk write activity.

Configure Azure Firewall to log all outbound traffic to a storage account.

Create a Sentinel analytics rule that alerts when outbound traffic from the VM to a known malicious IP exceeds a certain byte threshold.

Enable Azure Network Watcher packet capture on the VM to record all outbound traffic.

A security team wants to receive alerts when a specific IAM role is used to make API calls from an unusual geographic location. They have enabled CloudTrail in AWS and are sending logs to a SIEM. What is the best way to configure this alert?

Use AWS Config to monitor IAM role usage and alert on any changes.

Enable VPC Flow Logs and analyze traffic to the IAM endpoint.

Set up a CloudWatch alarm on the IAM role's API call count.

Create a SIEM rule that triggers when the source IP address of an API call is in a country not on the allowlist.

What is the primary purpose of integrating cloud network monitoring data into a SIEM platform?

To replace the need for any other security monitoring tools

To store raw packet captures for forensic analysis

To provide a centralized location for correlating and analyzing security events from multiple sources

To automatically block all malicious IP addresses without human intervention

GIAC Cloud Security Essentials

Domain 2Objective 3

Network Security Monitoring in the Cloud GCLD Practice Questions (Page 8)

Part of the Cloud Networking and Security domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 36–40

36expert · hard
A security team is planning to implement network monitoring in a new cloud environment. They are concerned about the shared responsibility model and want to ensure they have visibility into all layers of the network stack. Which approach best addresses this concern?
Select an answer first
37application · medium
During an incident response, a forensic investigator needs to determine which internal hosts communicated with a known malicious external IP over the past 30 days. The company uses AWS and has VPC Flow Logs enabled. What is the most efficient way to obtain this information?
Select an answer first
38application · medium
A company uses Azure and wants to detect data exfiltration attempts from a VM to an external IP. They have NSG flow logs enabled and Azure Sentinel. Which configuration would best detect this?
Select an answer first
39application · medium
A security team wants to receive alerts when a specific IAM role is used to make API calls from an unusual geographic location. They have enabled CloudTrail in AWS and are sending logs to a SIEM. What is the best way to configure this alert?
Select an answer first
40foundation · easy
What is the primary purpose of integrating cloud network monitoring data into a SIEM platform?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.