A cloud security team wants to detect when a storage bucket's access policy is changed to allow public read access. They have enabled logging for the storage service. Which log or event should the team monitor to detect this change?

Network flow logs for traffic to the bucket's endpoint

Management events that record policy changes to the bucket

Billing records that show increased costs for the bucket

Data-plane access logs that show read requests to the bucket

A company runs a web application that uses both object storage for static assets and a relational database for user data. The operations team wants to monitor the performance of both services from a single dashboard. Which monitoring data should the team collect for each service?

Object storage request latency and error rates, plus database query latency and connection counts

Application logs from the web server only

Object storage billing data and database backup status

Network traffic logs for the application server and database server

A company's backup strategy uses nightly backups to object storage with cross-region replication. The recovery point objective (RPO) is 15 minutes and the recovery time objective (RTO) is 2 hours. The backup team notices that replication lag sometimes exceeds 30 minutes. The team wants to ensure the RPO is met without changing the backup frequency. Which action should the team take?

Store backups in a single region to avoid replication lag entirely

Set the replication alert threshold to 30 minutes to match the observed lag

Enable continuous replication to the secondary region and monitor replication lag with an alert threshold of 15 minutes

Increase the frequency of nightly backups to every 6 hours

A cloud architect is designing a monitoring solution for a multi-tier application that uses object storage, a relational database, and a file share. The architect wants a single dashboard that shows the health of all storage components. Which approach is the most effective?

Use a third-party tool that only monitors object storage.

Monitor only the database because it is the most critical component.

Use a cloud monitoring service that aggregates metrics and logs from all storage services into a single dashboard.

Create separate dashboards for each storage service and switch between them.

GIAC Cloud Threat Detection

Domain 2Objective 3

Data and Storage Monitoring GCTD Practice Questions (Page 5)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

Questions 21–25

21application · medium
A cloud security team wants to detect when a storage bucket's access policy is changed to allow public read access. They have enabled logging for the storage service. Which log or event should the team monitor to detect this change?
Select an answer first
22foundation · easy
To ensure compliance with a data retention policy, which lifecycle event should be monitored to verify that data is removed after its required retention period?
Select an answer first
23application · medium
A company runs a web application that uses both object storage for static assets and a relational database for user data. The operations team wants to monitor the performance of both services from a single dashboard. Which monitoring data should the team collect for each service?
Select an answer first
24expert · hard
A company's backup strategy uses nightly backups to object storage with cross-region replication. The recovery point objective (RPO) is 15 minutes and the recovery time objective (RTO) is 2 hours. The backup team notices that replication lag sometimes exceeds 30 minutes. The team wants to ensure the RPO is met without changing the backup frequency. Which action should the team take?
Select an answer first
25expert · hard
A cloud architect is designing a monitoring solution for a multi-tier application that uses object storage, a relational database, and a file share. The architect wants a single dashboard that shows the health of all storage components. Which approach is the most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Data and Storage Monitoring GCTD Practice Questions (Page 5)

Questions 21–25

A cloud security team wants to detect when a storage bucket's access policy is changed to allow public read access. They have enabled logging for the storage service. Which log or event should the team monitor to detect this change?

To ensure compliance with a data retention policy, which lifecycle event should be monitored to verify that data is removed after its required retention period?

A company runs a web application that uses both object storage for static assets and a relational database for user data. The operations team wants to monitor the performance of both services from a single dashboard. Which monitoring data should the team collect for each service?

A cloud architect is designing a monitoring solution for a multi-tier application that uses object storage, a relational database, and a file share. The architect wants a single dashboard that shows the health of all storage components. Which approach is the most effective?

Keep studying — Cloud Infrastructure Monitoring