A security team is implementing cloud monitoring to support incident response. They want to ensure that when a threat is detected, they can quickly understand the scope of the incident. Which monitoring practice is most important for this goal?

Setting up real-time alerts for all security events to ensure immediate notification.

Creating a dashboard that shows the number of active alerts and their severity levels.

Storing logs in a centralized repository with a retention period of at least one year.

Correlating logs from different sources to reconstruct the sequence of events leading to the incident.

A security engineer is configuring a cloud monitoring solution and wants to ensure that it can detect threats that involve multiple steps, such as an attacker gaining access to a low-privilege account and then escalating privileges. Which monitoring capability is most important?

The ability to store logs for a minimum of 90 days.

The ability to generate real-time alerts for any privilege escalation event.

The ability to correlate events across time and services to identify attack chains.

The ability to visualize network traffic between all cloud services.

A security team is evaluating whether to build a custom cloud monitoring solution or purchase a commercial one. They have a small team and need to deploy quickly. What is the most important factor in this decision?

The time and expertise required to develop and maintain a custom solution versus the cost of a commercial product.

The ability to customize the monitoring solution to the company's exact needs.

The preference of the security team for open-source software.

The cloud provider's recommendation for monitoring tools.

A security engineer is configuring monitoring for a cloud environment that uses infrastructure as code (IaC) to deploy resources. The engineer wants to detect when unauthorized changes are made to the IaC templates. Which monitoring approach should they use?

Monitor the version control system (VCS) for changes to the IaC templates and alert on unauthorized modifications.

Monitor the cloud provider's API logs for resource creation events.

Monitor the cloud provider's billing reports for cost anomalies.

Monitor the CI/CD pipeline logs for build and deployment activities.

What is the primary purpose of cloud monitoring in the context of security operations?

To automatically remediate all security misconfigurations without human intervention

To ensure that all cloud resources are always available and performant

To replace the need for regular security assessments and penetration testing

To continuously collect and analyze telemetry from cloud resources to detect suspicious activity and assess the overall security posture

GIAC Cloud Threat Detection

Domain 1Objective 1

Cloud Monitoring Fundamentals GCTD Practice Questions (Page 5)

Part of the Cloud Monitoring Foundations domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

1concept

Questions 21–25

21application · medium
A security team is implementing cloud monitoring to support incident response. They want to ensure that when a threat is detected, they can quickly understand the scope of the incident. Which monitoring practice is most important for this goal?
Select an answer first
22application · medium
A security engineer is configuring a cloud monitoring solution and wants to ensure that it can detect threats that involve multiple steps, such as an attacker gaining access to a low-privilege account and then escalating privileges. Which monitoring capability is most important?
Select an answer first
23expert · hard
A security team is evaluating whether to build a custom cloud monitoring solution or purchase a commercial one. They have a small team and need to deploy quickly. What is the most important factor in this decision?
Select an answer first
24application · medium
A security engineer is configuring monitoring for a cloud environment that uses infrastructure as code (IaC) to deploy resources. The engineer wants to detect when unauthorized changes are made to the IaC templates. Which monitoring approach should they use?
Select an answer first
25foundation · easy
What is the primary purpose of cloud monitoring in the context of security operations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.