A company's disaster recovery plan requires that backups be restorable within 4 hours and that no more than 15 minutes of data be lost in the event of a failure. The backup team wants to monitor whether these targets are being met. Which metrics should the team track?

Storage capacity utilization and the number of objects in the backup bucket

The number of users who have access to the backup storage

Backup job duration, replication lag, and the time since the last successful backup

The cost of backup storage and the number of backup jobs run per month

A security analyst notices that a cloud database's query latency has spiked and the connection count has doubled over the past hour. The analyst wants to determine whether this is due to a legitimate increase in application traffic or a potential data exfiltration attempt. Which monitoring approach would best help the analyst make this determination?

Increase the database instance size to handle the additional load and observe if latency returns to normal

Check the database's storage utilization metrics to see if data volume has increased

Review database audit logs for unusual query patterns and correlate with application authentication logs

Disable public access to the database and require all connections to use a VPN

A cloud architect is designing a monitoring solution for a multi-account environment. The architect wants to centralize storage monitoring data from all accounts into a single dashboard. The architect also needs to ensure that only authorized security personnel can view the dashboard. Which approach should the architect take?

Store all logs in a public bucket and use a third-party tool to visualize them

Create a separate dashboard in each account and share the links with security personnel

Aggregate storage metrics and logs from all accounts into a central monitoring account and use role-based access control to restrict dashboard access

Use a single account for all storage and monitoring to simplify access control

A disaster recovery plan requires that a database be recoverable to a point within 15 minutes of any failure. The backup team runs a full backup every night and transaction log backups every 5 minutes. Which metric should be monitored to ensure the RPO is achievable?

The CPU usage of the database server during log backups.

The size of the full backup file.

The number of transaction log backups per day.

The time since the last successful transaction log backup.

GIAC Cloud Threat Detection

Domain 2Objective 3

Data and Storage Monitoring GCTD Practice Questions (Page 2)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

Questions 6–10

6foundation · easy
A database administrator wants to monitor the time it takes for queries to execute on a cloud database. Which metric should be tracked?
Select an answer first
7application · medium
A company's disaster recovery plan requires that backups be restorable within 4 hours and that no more than 15 minutes of data be lost in the event of a failure. The backup team wants to monitor whether these targets are being met. Which metrics should the team track?
Select an answer first
8application · medium
A security analyst notices that a cloud database's query latency has spiked and the connection count has doubled over the past hour. The analyst wants to determine whether this is due to a legitimate increase in application traffic or a potential data exfiltration attempt. Which monitoring approach would best help the analyst make this determination?
Select an answer first
9expert · hard
A cloud architect is designing a monitoring solution for a multi-account environment. The architect wants to centralize storage monitoring data from all accounts into a single dashboard. The architect also needs to ensure that only authorized security personnel can view the dashboard. Which approach should the architect take?
Select an answer first
10application · medium
A disaster recovery plan requires that a database be recoverable to a point within 15 minutes of any failure. The backup team runs a full backup every night and transaction log backups every 5 minutes. Which metric should be monitored to ensure the RPO is achievable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Data and Storage Monitoring GCTD Practice Questions (Page 2)

Questions 6–10

A database administrator wants to monitor the time it takes for queries to execute on a cloud database. Which metric should be tracked?

A company's disaster recovery plan requires that backups be restorable within 4 hours and that no more than 15 minutes of data be lost in the event of a failure. The backup team wants to monitor whether these targets are being met. Which metrics should the team track?

A disaster recovery plan requires that a database be recoverable to a point within 15 minutes of any failure. The backup team runs a full backup every night and transaction log backups every 5 minutes. Which metric should be monitored to ensure the RPO is achievable?

Keep studying — Cloud Infrastructure Monitoring