A security operations team wants to be notified immediately when a new service is installed on their Linux VMs. They have a monitoring tool that can watch for changes to systemd unit files. Which alerting configuration best meets this need?

Alert when a new .service file is created in /etc/systemd/system/

Alert when the /etc/init.d/ directory changes

Alert when the systemd daemon is reloaded

Alert when the system uptime changes

A host-based intrusion detection system (HIDS) on a Windows VM alerts on a PowerShell script that downloads an executable and runs it. The script is part of a legitimate software update process. What is the best way to handle this alert?

Change the HIDS to only alert on scripts run by non-admin users

Add a rule exception for the specific script hash and the update process

Disable PowerShell logging on the VM

A cloud operations team wants to detect memory exhaustion on their Windows VMs before applications crash. They need a metric that can be monitored in near real-time. Which metric should they collect and alert on?

Available MBytes (or available memory bytes)

A DevOps team is troubleshooting a memory leak on a Linux VM. They have collected memory usage metrics over time, but the metrics show a gradual increase followed by a sudden drop. They need to identify the process causing the leak. Which additional data should they collect?

Per-process memory usage over time

A company uses Google Cloud Platform (GCP) and wants to monitor host OS metrics and logs from their Compute Engine VMs. They need to create alerts for high CPU usage and suspicious log entries. Which integration approach is most effective?

Install the Cloud Monitoring agent (Ops Agent) on VMs to collect metrics and logs, and create alerts in Cloud Monitoring.

Use Cloud Logging only and create alerts based on log entries.

Use Cloud Monitoring only for metrics and manually check logs.

Export logs to BigQuery and use a separate tool for alerts.

GIAC Cloud Threat Detection

Domain 2Objective 1

Host OS Monitoring GCTD Practice Questions (Page 10)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 46–50

46application · medium
A security operations team wants to be notified immediately when a new service is installed on their Linux VMs. They have a monitoring tool that can watch for changes to systemd unit files. Which alerting configuration best meets this need?
Select an answer first
47application · medium
A host-based intrusion detection system (HIDS) on a Windows VM alerts on a PowerShell script that downloads an executable and runs it. The script is part of a legitimate software update process. What is the best way to handle this alert?
Select an answer first
48application · medium
A cloud operations team wants to detect memory exhaustion on their Windows VMs before applications crash. They need a metric that can be monitored in near real-time. Which metric should they collect and alert on?
Select an answer first
49expert · hard
A DevOps team is troubleshooting a memory leak on a Linux VM. They have collected memory usage metrics over time, but the metrics show a gradual increase followed by a sudden drop. They need to identify the process causing the leak. Which additional data should they collect?
Select an answer first
50expert · hard
A company uses Google Cloud Platform (GCP) and wants to monitor host OS metrics and logs from their Compute Engine VMs. They need to create alerts for high CPU usage and suspicious log entries. Which integration approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.