A company runs a critical application on a Linux VM. The application occasionally spikes to high CPU usage, but the team cannot distinguish between normal spikes and a potential cryptocurrency miner. They want to set an alert that minimizes false positives while still detecting mining activity. Which approach is most effective?

Create a baseline of normal CPU usage per process and alert on deviations from that baseline

Alert on any process that exceeds 80% CPU for more than 5 minutes

Alert when total CPU usage exceeds 90% for any duration

Disable CPU monitoring and rely on network traffic analysis

A cloud security architect is designing a monitoring strategy for a fleet of VMs. They need to ensure that the strategy provides visibility into host-level security events and resource usage. Which combination of monitoring activities is most comprehensive?

Only monitoring CPU and memory metrics

Collecting OS logs, monitoring CPU/memory metrics, and performing file integrity checks

Only performing file integrity checks

A Linux host's /var/log/auth.log shows multiple failed SSH login attempts from a single IP address over a short period, followed by a successful login. The analyst needs to determine if the successful login was legitimate. Which additional data source would be most useful?

The command history of the user who logged in

The process list and network connections from the time of the successful login

An organization uses AWS CloudWatch for cloud-level monitoring and wants to forward Linux host OS logs (auth.log, syslog) to CloudWatch Logs for centralized analysis. Which approach should they use?

Enable AWS Config to collect /var/log/auth.log

Install the CloudWatch Logs agent (or unified agent) on each EC2 instance and configure it to stream the log files

Configure the VPC Flow Logs to include host OS logs

Use AWS CloudTrail to capture host OS logs

A HIDS on a Linux VM alerts on a process that is attempting to modify /etc/shadow. The process is the legitimate 'passwd' command run by a system administrator. The HIDS is generating too many false positives. What is the best way to reduce false positives while maintaining detection of unauthorized attempts to access /etc/shadow?

Change the HIDS to only alert on writes to /etc/shadow from non-root users

Disable the HIDS rule for /etc/shadow entirely

Create a rule exception for the 'passwd' binary when run by the root user

Increase the alert threshold to require 5 attempts before alerting

GIAC Cloud Threat Detection

Domain 2Objective 1

Host OS Monitoring GCTD Practice Questions (Page 4)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 16–20

16expert · hard
A company runs a critical application on a Linux VM. The application occasionally spikes to high CPU usage, but the team cannot distinguish between normal spikes and a potential cryptocurrency miner. They want to set an alert that minimizes false positives while still detecting mining activity. Which approach is most effective?
Select an answer first
17application · medium
A cloud security architect is designing a monitoring strategy for a fleet of VMs. They need to ensure that the strategy provides visibility into host-level security events and resource usage. Which combination of monitoring activities is most comprehensive?
Select an answer first
18application · medium
A Linux host's /var/log/auth.log shows multiple failed SSH login attempts from a single IP address over a short period, followed by a successful login. The analyst needs to determine if the successful login was legitimate. Which additional data source would be most useful?
Select an answer first
19application · medium
An organization uses AWS CloudWatch for cloud-level monitoring and wants to forward Linux host OS logs (auth.log, syslog) to CloudWatch Logs for centralized analysis. Which approach should they use?
Select an answer first
20expert · hard
A HIDS on a Linux VM alerts on a process that is attempting to modify /etc/shadow. The process is the legitimate 'passwd' command run by a system administrator. The HIDS is generating too many false positives. What is the best way to reduce false positives while maintaining detection of unauthorized attempts to access /etc/shadow?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Host OS Monitoring GCTD Practice Questions (Page 4)

Questions 16–20

A cloud security architect is designing a monitoring strategy for a fleet of VMs. They need to ensure that the strategy provides visibility into host-level security events and resource usage. Which combination of monitoring activities is most comprehensive?

A Linux host's /var/log/auth.log shows multiple failed SSH login attempts from a single IP address over a short period, followed by a successful login. The analyst needs to determine if the successful login was legitimate. Which additional data source would be most useful?

An organization uses AWS CloudWatch for cloud-level monitoring and wants to forward Linux host OS logs (auth.log, syslog) to CloudWatch Logs for centralized analysis. Which approach should they use?

Keep studying — Cloud Infrastructure Monitoring