Investigating AWS Environments GCTD Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is reviewing a GuardDuty finding that indicates a possible credential compromise. The analyst needs to determine whether the compromised credentials were used to launch new EC2 instances. Which AWS service or feature should the analyst use to correlate the GuardDuty finding with the instance launch activity?

   • AAWS Config resource inventory
   • BVPC Flow Logs
   • CCloudTrail event history
   • DS3 access logs
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is triaging multiple GuardDuty findings. One finding is `UnauthorizedAccess:EC2/SSHBruteForce` on a bastion host, and another is `Policy:IAMUser/RootCredentialUsage` for the root account. The team has limited resources and must prioritize. Which finding should be addressed first?

   • ABoth findings equally, because they are both critical
   • BThe root credential usage finding, because it indicates a potential compromise of the root account
   • CNeither finding, because GuardDuty findings are not always accurate
   • DThe SSH brute force finding, because it is an active attack
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team needs to detect when a new IAM policy is attached to a privileged role. They want to be alerted in near real-time. Which combination of AWS services should they use?

   • AAWS Config and SNS
   • BCloudTrail and CloudWatch Events
   • CVPC Flow Logs and CloudWatch Logs Insights
   • DGuardDuty and Lambda
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which AWS service continuously analyzes AWS account activity and network traffic to generate security findings that can indicate unauthorized behavior?

   • AAWS CloudTrail
   • BAWS Config
   • CAmazon GuardDuty
   • DAmazon Macie
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is investigating a possible data exfiltration from a private subnet. VPC Flow Logs show a large volume of outbound traffic to an external IP on port 443. The analyst needs to determine if the traffic was encrypted or if it was plaintext. Which additional data source would best help?

   • APacket capture on the instance
   • BCloudTrail for API calls that may have initiated the transfer
   • CAWS Config for security group changes
   • DGuardDuty findings
   Reveal Solution Discussion Select an answer first