A security analyst is reviewing alerts for a file share that contains sensitive data. The alert system flags any access from an IP address outside the corporate network. The analyst notices that a legitimate backup service uses a third-party IP range that changes frequently. What is the best way to reduce false positives without missing real threats?

Require multi-factor authentication for all file share access.

Add the third-party IP range to an allowlist and suppress alerts from those IPs.

Change the alert threshold to only trigger on access from countries where the company does not operate.

Disable alerts for external IP access entirely.

What does monitoring the status of backup jobs primarily help an organization ensure?

That database queries are optimized

That storage costs are minimized

That backups complete successfully and data is recoverable

That access policies are compliant

A security analyst is investigating a potential data breach. The analyst sees that a large number of database records were exported to an object storage bucket, and then the bucket was made public. The analyst wants to determine whether the export was performed by a legitimate application or by an attacker. Which evidence would most strongly indicate an attacker?

The database query latency increased during the export, but the export size was within normal limits

The export occurred during business hours and the bucket was made public during a scheduled maintenance window

The export was performed using a service account that normally only reads data, and the bucket was made public immediately after

The export used the same API calls as the application's normal nightly reporting job

A company uses a cloud object storage service for critical backups. The backup job runs nightly and replicates to a secondary region. The security team wants to be notified if a backup job fails or if replication falls behind by more than one hour. Which monitoring setup should the team implement?

Set up a separate bucket to store backup logs and review them manually each week

Configure a storage class transition to move backups to cold storage after 90 days

Create a metric filter for backup job status and replication lag, then trigger an alert to the incident management system

Enable versioning on the backup bucket and set a lifecycle rule to delete old versions after 30 days

GIAC Cloud Threat Detection

Domain 2Objective 3

Data and Storage Monitoring GCTD Practice Questions (Page 6)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

Questions 26–30

26foundation · easy
Which type of monitoring data is most useful for detecting unauthorized access to a cloud storage bucket by analyzing API calls?
Select an answer first
27expert · hard
A security analyst is reviewing alerts for a file share that contains sensitive data. The alert system flags any access from an IP address outside the corporate network. The analyst notices that a legitimate backup service uses a third-party IP range that changes frequently. What is the best way to reduce false positives without missing real threats?
Select an answer first
28foundation · easy
What does monitoring the status of backup jobs primarily help an organization ensure?
Select an answer first
29expert · hard
A security analyst is investigating a potential data breach. The analyst sees that a large number of database records were exported to an object storage bucket, and then the bucket was made public. The analyst wants to determine whether the export was performed by a legitimate application or by an attacker. Which evidence would most strongly indicate an attacker?
Select an answer first
30application · medium
A company uses a cloud object storage service for critical backups. The backup job runs nightly and replicates to a secondary region. The security team wants to be notified if a backup job fails or if replication falls behind by more than one hour. Which monitoring setup should the team implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Data and Storage Monitoring GCTD Practice Questions (Page 6)

Questions 26–30

Which type of monitoring data is most useful for detecting unauthorized access to a cloud storage bucket by analyzing API calls?

What does monitoring the status of backup jobs primarily help an organization ensure?

A company uses a cloud object storage service for critical backups. The backup job runs nightly and replicates to a secondary region. The security team wants to be notified if a backup job fails or if replication falls behind by more than one hour. Which monitoring setup should the team implement?

Keep studying — Cloud Infrastructure Monitoring