A company is subject to a regulation that requires data to be retained for 5 years, but also requires that data be deleted immediately upon a user's request. They use an object storage bucket with a lifecycle policy that deletes objects after 5 years. How should they handle the conflict between retention and deletion requests?

Store the data in a separate bucket that does not have a lifecycle policy.

Use a legal hold or object lock to prevent deletion until the retention period expires, and monitor for any deletion attempts.

Ignore the user deletion requests and rely on the 5-year lifecycle policy.

Allow the lifecycle policy to delete objects immediately upon user request, overriding the retention requirement.

A cloud engineer is monitoring a virtual machine's attached disk. Which type of storage service is being monitored, and which metric is most relevant for performance?

Database storage; query latency

A security operations team wants to automatically respond when an object storage bucket's encryption is disabled. Which approach is the most effective?

Set up a bucket policy that denies all writes if encryption is disabled.

Create a daily job that checks the encryption status and reports any changes.

Enable access logging and review the logs weekly for encryption changes.

Configure an event-driven function that re-enables encryption and sends an alert when a disable event is detected.

A backup administrator needs to ensure that nightly backups of a critical database are completing successfully and that the recovery point objective (RPO) of 24 hours is met. Which metric should be monitored to directly verify the RPO?

The total size of the backup files stored.

The time elapsed since the last successful backup.

The CPU utilization of the backup server during the backup window.

The number of backup jobs that ran in the last month.

GIAC Cloud Threat Detection

Domain 2Objective 3

Data and Storage Monitoring GCTD Practice Questions (Page 10)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

Questions 46–50

46foundation · easy
A security analyst is setting up monitoring for a cloud object storage bucket. Which type of monitoring data would provide a chronological record of who accessed the bucket and from which IP address?
Select an answer first
47expert · hard
A company is subject to a regulation that requires data to be retained for 5 years, but also requires that data be deleted immediately upon a user's request. They use an object storage bucket with a lifecycle policy that deletes objects after 5 years. How should they handle the conflict between retention and deletion requests?
Select an answer first
48foundation · easy
A cloud engineer is monitoring a virtual machine's attached disk. Which type of storage service is being monitored, and which metric is most relevant for performance?
Select an answer first
49application · medium
A security operations team wants to automatically respond when an object storage bucket's encryption is disabled. Which approach is the most effective?
Select an answer first
50application · medium
A backup administrator needs to ensure that nightly backups of a critical database are completing successfully and that the recovery point objective (RPO) of 24 hours is met. Which metric should be monitored to directly verify the RPO?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Data and Storage Monitoring GCTD Practice Questions (Page 10)

Questions 46–50

A security analyst is setting up monitoring for a cloud object storage bucket. Which type of monitoring data would provide a chronological record of who accessed the bucket and from which IP address?

A cloud engineer is monitoring a virtual machine's attached disk. Which type of storage service is being monitored, and which metric is most relevant for performance?

A security operations team wants to automatically respond when an object storage bucket's encryption is disabled. Which approach is the most effective?

A backup administrator needs to ensure that nightly backups of a critical database are completing successfully and that the recovery point objective (RPO) of 24 hours is met. Which metric should be monitored to directly verify the RPO?

Keep studying — Cloud Infrastructure Monitoring