What is the primary purpose of file integrity monitoring (FIM) on a cloud host?

To ensure that all files are encrypted at rest.

To automatically back up critical files to cloud storage.

To monitor network traffic to and from the host.

To detect unauthorized changes to critical files, such as system binaries and configuration files.

Which of the following is a primary purpose of monitoring host OS logs in a cloud environment?

To detect security events and anomalies such as unauthorized login attempts or privilege escalation

To track the physical location of the cloud data center

To automatically patch the operating system

To replace the need for application-level logging

Which technique is commonly used by file integrity monitoring tools to detect changes to files?

Analyzing network packets for malicious payloads.

Comparing cryptographic hashes of files against a known-good baseline.

Scanning files for known malware signatures.

Monitoring CPU usage of processes that access the files.

A security architect is designing host OS monitoring for a hybrid cloud environment. The company has both on-premises and cloud VMs. They want a single solution that provides file integrity monitoring, host-based intrusion detection, and centralized alerting. Which approach best meets this requirement?

Deploy a single HIDS/FIM agent on all VMs and forward alerts to a central SIEM

Use only cloud-provider monitoring and ignore on-premises hosts

Use separate cloud-native monitoring tools for cloud VMs and on-premises tools for on-premises VMs

Deploy FIM on cloud VMs and HIDS on on-premises VMs

Which of the following is a benefit of integrating host OS monitoring with a cloud-native monitoring service?

It allows security alerts from multiple VMs to be correlated and managed in a single dashboard.

It eliminates the need for any other security tools.

It automatically patches all guest OS vulnerabilities.

It guarantees that no security incident will occur.

GIAC Cloud Threat Detection

Domain 2Objective 1

Host OS Monitoring GCTD Practice Questions (Page 6)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 26–30

26foundation · easy
What is the primary purpose of file integrity monitoring (FIM) on a cloud host?
Select an answer first
27foundation · easy
Which of the following is a primary purpose of monitoring host OS logs in a cloud environment?
Select an answer first
28foundation · easy
Which technique is commonly used by file integrity monitoring tools to detect changes to files?
Select an answer first
29expert · hard
A security architect is designing host OS monitoring for a hybrid cloud environment. The company has both on-premises and cloud VMs. They want a single solution that provides file integrity monitoring, host-based intrusion detection, and centralized alerting. Which approach best meets this requirement?
Select an answer first
30foundation · easy
Which of the following is a benefit of integrating host OS monitoring with a cloud-native monitoring service?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.