While analyzing a CloudTrail log entry, an investigator sees an event with `"eventName": "StopLogging"` for the CloudTrail trail itself. What should this event suggest to the investigator?

A misconfiguration in the S3 bucket that stores the logs

An automatic rotation of the CloudTrail log files

Normal maintenance activity that requires no further attention

A potential attempt to disable audit logging to evade detection

A compromised EC2 instance is running a cryptominer. The security team needs to preserve forensic evidence while minimizing downtime. The instance is part of an auto scaling group and may be terminated automatically. Which approach best balances evidence preservation and operational continuity?

Terminate the instance immediately and rely on CloudTrail logs

Use AWS Config to revert the instance to a known good state

Create a snapshot of the EBS volumes, then detach the instance from the auto scaling group and isolate it

Copy the instance's memory to S3 using a script

A security analyst is investigating a compromised EC2 instance that is sending large amounts of data to an external IP. VPC Flow Logs show the traffic, but the analyst needs to determine if the data is encrypted and whether it is being exfiltrated. The instance is running a custom application that uses TLS. Which approach would provide the most definitive evidence of data exfiltration?

Use AWS Config to see if the instance's IAM role has S3 permissions

Check the instance's security group for open outbound ports

Use VPC Traffic Mirroring to capture the traffic and analyze the TLS handshake and data patterns

Review the instance's CloudWatch Logs for application-level errors

GIAC Cloud Threat Detection

Domain 4Objective 1

Investigating AWS Environments GCTD Practice Questions (Page 2)

Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 6–10

6foundation · easy
Which CloudWatch Logs Insights query command is used to extract a specific field from log events for further analysis?
Select an answer first
7foundation · easy
While analyzing a CloudTrail log entry, an investigator sees an event with `"eventName": "StopLogging"` for the CloudTrail trail itself. What should this event suggest to the investigator?
Select an answer first
8expert · hard
A compromised EC2 instance is running a cryptominer. The security team needs to preserve forensic evidence while minimizing downtime. The instance is part of an auto scaling group and may be terminated automatically. Which approach best balances evidence preservation and operational continuity?
Select an answer first
9expert · hard
A security analyst is investigating a compromised EC2 instance that is sending large amounts of data to an external IP. VPC Flow Logs show the traffic, but the analyst needs to determine if the data is encrypted and whether it is being exfiltrated. The instance is running a custom application that uses TLS. Which approach would provide the most definitive evidence of data exfiltration?
Select an answer first
10foundation · easy
Which AWS service can be used to create an isolated environment for analyzing a compromised EC2 instance without affecting the production network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Investigating AWS Environments GCTD Practice Questions (Page 2)

Questions 6–10

Which CloudWatch Logs Insights query command is used to extract a specific field from log events for further analysis?

While analyzing a CloudTrail log entry, an investigator sees an event with `"eventName": "StopLogging"` for the CloudTrail trail itself. What should this event suggest to the investigator?

A compromised EC2 instance is running a cryptominer. The security team needs to preserve forensic evidence while minimizing downtime. The instance is part of an auto scaling group and may be terminated automatically. Which approach best balances evidence preservation and operational continuity?

Which AWS service can be used to create an isolated environment for analyzing a compromised EC2 instance without affecting the production network?

Keep studying — Cloud Provider Investigations