Which of the following is an example of a response action that can be defined for a host OS security alert?

Automatically change the cloud provider's region.

Automatically increase the VM's CPU quota.

Automatically isolate the VM from the network.

Automatically delete all user accounts on the host.

Which of the following is a primary benefit of monitoring host operating systems in a cloud environment?

It allows the cloud provider to automatically scale the customer's applications.

It enables early detection of security threats and performance anomalies within the guest OS and applications.

It eliminates the need for separate security monitoring tools.

It guarantees that the cloud provider will patch the guest OS automatically.

A DevOps team is experiencing intermittent performance issues on a cloud VM. They need to identify whether the issue is due to CPU saturation, memory pressure, or disk I/O. Which set of metrics should they collect and analyze?

Application-level response times only

Only disk I/O and network throughput

Only CPU utilization and memory usage

CPU utilization, memory usage, disk I/O, and network throughput

A security team needs to detect changes to critical configuration files on Windows servers. They want to use a cloud-native service that integrates with Azure Security Center. Which solution should they choose?

Deploy a third-party FIM agent and send alerts to a custom SIEM.

Use Azure Policy to audit file changes.

Enable Azure Security Center's File Integrity Monitoring (FIM) feature.

Use Azure Monitor to collect Windows Event Logs.

A cloud security team is designing a monitoring strategy for a hybrid cloud environment with both on-premises and cloud VMs. They need a unified view of host security and performance. Which approach best achieves this?

Only monitor cloud VMs and rely on on-premises tools for local hosts.

Use cloud-native monitoring only for all VMs.

Use separate monitoring tools for on-premises and cloud VMs.

Deploy the same monitoring agent on all VMs and forward data to a central SIEM.

GIAC Cloud Threat Detection

Domain 2Objective 1

Host OS Monitoring GCTD Practice Questions (Page 5)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 21–25

21foundation · easy
Which of the following is an example of a response action that can be defined for a host OS security alert?
Select an answer first
22foundation · easy
Which of the following is a primary benefit of monitoring host operating systems in a cloud environment?
Select an answer first
23application · medium
A DevOps team is experiencing intermittent performance issues on a cloud VM. They need to identify whether the issue is due to CPU saturation, memory pressure, or disk I/O. Which set of metrics should they collect and analyze?
Select an answer first
24application · medium
A security team needs to detect changes to critical configuration files on Windows servers. They want to use a cloud-native service that integrates with Azure Security Center. Which solution should they choose?
Select an answer first
25expert · hard
A cloud security team is designing a monitoring strategy for a hybrid cloud environment with both on-premises and cloud VMs. They need a unified view of host security and performance. Which approach best achieves this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.