
GIAC Cloud Threat Detection
Domain 2Objective 3
Data and Storage Monitoring GCTD Practice Questions (Page 9)
Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)
53questions here
11free pages
8concepts
Questions 41–45
- 41
A company must retain financial records for seven years, but wants to automatically delete temporary files after 30 days. The compliance team also needs to be able to prove that no data was deleted before the retention period ended. Which combination of monitoring and data lifecycle controls should be implemented?
Select an answer first - 42
A database administrator is investigating a potential data breach. The audit logs show that a large number of SELECT queries were executed by a single user account over a short period. The queries returned a large volume of data. Which additional log source would help determine if the data was actually exfiltrated?
Select an answer first - 43
A security analyst notices that a cloud database's connection count spikes to 10x normal for 15 minutes every night at 2:00 AM, but no corresponding increase in query latency or CPU is observed. The analyst suspects a legitimate batch job but wants to confirm. Which monitoring approach would best validate the cause without creating noise?
Select an answer first - 44
A database administrator is troubleshooting a performance issue. The database's query latency is high, but CPU and memory utilization are normal. The administrator suspects that the issue is due to inefficient queries or locking. Which monitoring data would best help confirm this suspicion?
Select an answer first - 45
A company's backup strategy uses nightly backups to object storage with a 30-day retention period. The company's recovery point objective (RPO) is 24 hours and the recovery time objective (RTO) is 12 hours. The backup team wants to reduce the RTO to 4 hours without increasing the backup frequency. Which action should the team take?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.