A security team needs to identify all EC2 instances that have been communicating with a known malicious IP address over the past 24 hours. The team has VPC Flow Logs and CloudTrail logs in CloudWatch Logs. Which query approach would be most efficient?

Use CloudWatch Logs Insights on the VPC Flow Logs log group to filter for the malicious IP

Use CloudTrail logs to find API calls from the malicious IP

Use AWS Config to list instances and then manually check each one

Use GuardDuty findings to identify instances communicating with the IP

A company's security team is investigating a potential data exfiltration from an EC2 instance. They have enabled VPC Flow Logs and CloudTrail. Which combination of data sources would best help them determine if a large amount of data was transferred out of the instance to an external IP?

AWS Config for network flow data

S3 access logs for instance traffic

VPC Flow Logs for traffic volume and CloudTrail for API calls

CloudTrail alone for all network traffic

GIAC Cloud Threat Detection

Domain 4Objective 1

Investigating AWS Environments GCTD Practice Questions (Page 5)

Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 21–25

21application · medium
A security team needs to identify all EC2 instances that have been communicating with a known malicious IP address over the past 24 hours. The team has VPC Flow Logs and CloudTrail logs in CloudWatch Logs. Which query approach would be most efficient?
Select an answer first
22foundation · easy
An analyst needs to run a query across multiple log groups to find all API calls made by a specific IAM user. Which AWS service provides a query language for searching and aggregating log data?
Select an answer first
23application · medium
A company's security team is investigating a potential data exfiltration from an EC2 instance. They have enabled VPC Flow Logs and CloudTrail. Which combination of data sources would best help them determine if a large amount of data was transferred out of the instance to an external IP?
Select an answer first
24foundation · easy
Which AWS Config feature allows an investigator to compare the current configuration of a resource to a desired baseline to detect drift?
Select an answer first
25foundation · easy
In an S3 access log record, which field indicates the AWS account or IAM user that made the request?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Investigating AWS Environments GCTD Practice Questions (Page 5)

Questions 21–25

A security team needs to identify all EC2 instances that have been communicating with a known malicious IP address over the past 24 hours. The team has VPC Flow Logs and CloudTrail logs in CloudWatch Logs. Which query approach would be most efficient?

An analyst needs to run a query across multiple log groups to find all API calls made by a specific IAM user. Which AWS service provides a query language for searching and aggregating log data?

A company's security team is investigating a potential data exfiltration from an EC2 instance. They have enabled VPC Flow Logs and CloudTrail. Which combination of data sources would best help them determine if a large amount of data was transferred out of the instance to an external IP?

Which AWS Config feature allows an investigator to compare the current configuration of a resource to a desired baseline to detect drift?

In an S3 access log record, which field indicates the AWS account or IAM user that made the request?

Keep studying — Cloud Provider Investigations