A security analyst is investigating a potential data exfiltration from an object storage bucket. The analyst has access to the bucket's access logs. Which log attribute would be most useful to identify the source of the unauthorized access?

The source IP address of the API call.

The storage class of the object.

The size of the object accessed.

A company must comply with a regulation that requires data to be retained for at least three years, but also requires that data be deleted after five years. The storage administrator wants to automate this process and ensure that no data is deleted before three years or retained beyond five years. Which approach should the administrator take?

Use a lifecycle rule to delete objects after three years and rely on backups for recovery

Use object lock with a retention period of three years and a lifecycle rule to delete objects after five years

Manually delete objects after five years and document the process

Enable versioning and keep all versions indefinitely

A financial institution is required to archive transaction records for 10 years and then purge them. They use a cloud object storage service with lifecycle policies. Which monitoring activity is essential to prove compliance with the purge requirement?

Monitoring the total storage cost of the archive bucket.

Monitoring lifecycle execution logs to confirm that objects are deleted after the retention period.

Monitoring the number of objects added to the bucket daily.

Monitoring the bucket's public access settings.

A company runs a web application that stores user uploads in an object storage bucket. Users report that uploads sometimes fail during peak hours. The bucket's availability metric shows 99.9% uptime. Which additional metric should be monitored to diagnose the failures?

The bucket's encryption key rotation schedule.

The total number of objects in the bucket.

The bucket's lifecycle rule configuration.

The number of HTTP 503 (Service Unavailable) responses from the bucket.

GIAC Cloud Threat Detection

Domain 2Objective 3

Data and Storage Monitoring GCTD Practice Questions (Page 1)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

Questions 1–5

1application · medium
A security analyst is investigating a potential data exfiltration from an object storage bucket. The analyst has access to the bucket's access logs. Which log attribute would be most useful to identify the source of the unauthorized access?
Select an answer first
2expert · hard
A company must comply with a regulation that requires data to be retained for at least three years, but also requires that data be deleted after five years. The storage administrator wants to automate this process and ensure that no data is deleted before three years or retained beyond five years. Which approach should the administrator take?
Select an answer first
3application · medium
A financial institution is required to archive transaction records for 10 years and then purge them. They use a cloud object storage service with lifecycle policies. Which monitoring activity is essential to prove compliance with the purge requirement?
Select an answer first
4foundation · easy
Which cloud storage service type is best suited for storing unstructured data such as images, videos, and backups, and is commonly monitored for request rate and bucket size?
Select an answer first
5application · medium
A company runs a web application that stores user uploads in an object storage bucket. Users report that uploads sometimes fail during peak hours. The bucket's availability metric shows 99.9% uptime. Which additional metric should be monitored to diagnose the failures?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Data and Storage Monitoring GCTD Practice Questions (Page 1)

Questions 1–5

A security analyst is investigating a potential data exfiltration from an object storage bucket. The analyst has access to the bucket's access logs. Which log attribute would be most useful to identify the source of the unauthorized access?

A financial institution is required to archive transaction records for 10 years and then purge them. They use a cloud object storage service with lifecycle policies. Which monitoring activity is essential to prove compliance with the purge requirement?

Which cloud storage service type is best suited for storing unstructured data such as images, videos, and backups, and is commonly monitored for request rate and bucket size?

A company runs a web application that stores user uploads in an object storage bucket. Users report that uploads sometimes fail during peak hours. The bucket's availability metric shows 99.9% uptime. Which additional metric should be monitored to diagnose the failures?

Keep studying — Cloud Infrastructure Monitoring