A company is required to retain customer data for five years, but also needs to ensure that data is not accidentally deleted before the retention period ends. The storage administrator wants to implement a monitoring solution that alerts if any object is deleted prematurely. What should the administrator configure?

Create a bucket policy that denies delete permissions to all users

Set up a lifecycle rule to transition objects to cold storage after one year

Enable object lock with retention and monitor deletion events for any attempts to delete locked objects

Enable versioning and rely on previous versions to restore deleted objects

A security team wants to automate the response to a backup failure. The backup job is critical and must succeed within 4 hours. Which automated response is the most appropriate?

Trigger an incident ticket and page the on-call engineer immediately when the backup job fails.

Automatically restart the backup job and only alert if the retry also fails.

Ignore the failure and wait for the next scheduled backup.

Automatically delete the backup job and create a new one.

A company uses an object storage bucket to store sensitive customer documents. The security team wants to be notified if the bucket's access policy changes to allow public read access. Which configuration should be implemented?

Set up an event-driven notification that triggers on bucket policy modification events and sends an alert to the security team.

Enable bucket-level logging and review the logs weekly for anonymous GET requests.

Configure a lifecycle rule to expire the bucket contents if the policy changes.

Use a storage class that automatically blocks public access.

GIAC Cloud Threat Detection

Domain 2Objective 3

Data and Storage Monitoring GCTD Practice Questions (Page 3)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

Questions 11–15

11foundation · easy
Which data lifecycle event is monitored to ensure that data is automatically moved to cheaper storage after a specified period?
Select an answer first
12application · medium
A company is required to retain customer data for five years, but also needs to ensure that data is not accidentally deleted before the retention period ends. The storage administrator wants to implement a monitoring solution that alerts if any object is deleted prematurely. What should the administrator configure?
Select an answer first
13foundation · easy
A security team wants to detect storage buckets that are publicly accessible. Which monitoring activity would directly identify this misconfiguration?
Select an answer first
14expert · hard
A security team wants to automate the response to a backup failure. The backup job is critical and must succeed within 4 hours. Which automated response is the most appropriate?
Select an answer first
15application · medium
A company uses an object storage bucket to store sensitive customer documents. The security team wants to be notified if the bucket's access policy changes to allow public read access. Which configuration should be implemented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Data and Storage Monitoring GCTD Practice Questions (Page 3)

Questions 11–15

Which data lifecycle event is monitored to ensure that data is automatically moved to cheaper storage after a specified period?

A security team wants to detect storage buckets that are publicly accessible. Which monitoring activity would directly identify this misconfiguration?

A security team wants to automate the response to a backup failure. The backup job is critical and must succeed within 4 hours. Which automated response is the most appropriate?

A company uses an object storage bucket to store sensitive customer documents. The security team wants to be notified if the bucket's access policy changes to allow public read access. Which configuration should be implemented?

Keep studying — Cloud Infrastructure Monitoring