A cloud security team wants to detect host-based intrusions on Windows VMs. They need a solution that can analyze system calls and process activity in real time, and integrate with their existing SIEM. Which approach best meets these requirements?

Install antivirus software on the VM.

Enable Windows Event Log for security events only.

Deploy Sysmon with a configuration that logs process creation and network connections, and forward events to the SIEM.

Use a network-based IDS to monitor traffic to the VM.

Which of the following is a typical data source that a host-based intrusion detection system (HIDS) uses to detect suspicious activity?

DNS query logs from the cloud DNS service.

Network flow logs from the cloud load balancer.

Operating system logs and file integrity data.

Cloud provider's billing records.

A security analyst is investigating a suspicious process on a Linux VM. The process name is 'httpd' but it is running from /tmp and has a high CPU usage. The analyst wants to confirm whether this is the legitimate Apache web server. Which check would be most definitive?

Check the system's running services list

Look at the process's parent process ID

Check the process's network connections to see if it is listening on port 80

Compare the process's executable path and command-line arguments to the known Apache binary location

A security team is investigating a potential rootkit on a Linux VM. The process list shows a process named 'kworker' that is using high CPU. The team suspects the process is hidden or spoofed. Which technique would best confirm whether the process is legitimate?

Check the process's parent process ID

Verify the process's executable path

Look at the process's CPU usage over time

Compare the process list from /proc with the output of 'ps' and 'top'

GIAC Cloud Threat Detection

Domain 2Objective 1

Host OS Monitoring GCTD Practice Questions (Page 9)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 41–45

41application · medium
A cloud security team wants to detect host-based intrusions on Windows VMs. They need a solution that can analyze system calls and process activity in real time, and integrate with their existing SIEM. Which approach best meets these requirements?
Select an answer first
42foundation · easy
A security analyst wants to detect a memory leak in an application running on a cloud VM. Which host-level metric should be monitored over time?
Select an answer first
43foundation · easy
Which of the following is a typical data source that a host-based intrusion detection system (HIDS) uses to detect suspicious activity?
Select an answer first
44application · medium
A security analyst is investigating a suspicious process on a Linux VM. The process name is 'httpd' but it is running from /tmp and has a high CPU usage. The analyst wants to confirm whether this is the legitimate Apache web server. Which check would be most definitive?
Select an answer first
45expert · hard
A security team is investigating a potential rootkit on a Linux VM. The process list shows a process named 'kworker' that is using high CPU. The team suspects the process is hidden or spoofed. Which technique would best confirm whether the process is legitimate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.