A Lambda function is suspected of being used to exfiltrate data. The analyst needs to determine what the function did and what permissions it used. Which two data sources should the analyst examine?

CloudWatch Logs for the function and IAM role policies

S3 access logs and GuardDuty findings

An analyst is investigating a potential privilege escalation where an IAM user was added to an administrator group. The analyst needs to determine if the user actually used the new privileges. Which evidence would be most conclusive?

CloudTrail logs showing API calls made by the user after the group membership change

AWS Config showing the group membership change

GuardDuty findings for the user

A security analyst sees a GuardDuty finding of type `UnauthorizedAccess:EC2/SSHBruteForce` for an EC2 instance. The analyst checks CloudTrail and finds no API calls from the instance's role. What is the most appropriate immediate action to validate the finding and prevent further compromise?

Enable VPC Flow Logs for the instance's subnet

Isolate the instance by removing its public IP and updating the security group to block inbound SSH

Terminate the instance immediately to stop the attack

Ignore the finding because CloudTrail shows no API calls

GIAC Cloud Threat Detection

Domain 4Objective 1

Investigating AWS Environments GCTD Practice Questions (Page 6)

Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 26–30

26application · medium
A Lambda function is suspected of being used to exfiltrate data. The analyst needs to determine what the function did and what permissions it used. Which two data sources should the analyst examine?
Select an answer first
27foundation · easy
A security team wants to view security findings from GuardDuty, Security Hub, and Macie in a single dashboard. Which AWS service provides a centralized view of security findings across multiple AWS services?
Select an answer first
28expert · hard
An analyst is investigating a potential privilege escalation where an IAM user was added to an administrator group. The analyst needs to determine if the user actually used the new privileges. Which evidence would be most conclusive?
Select an answer first
29application · medium
A security analyst is reviewing S3 access logs and notices a large number of GET requests from a single IP address. The analyst wants to determine if the requests were successful and if any objects were actually downloaded. Which fields in the S3 access log should the analyst examine?
Select an answer first
30application · medium
A security analyst sees a GuardDuty finding of type `UnauthorizedAccess:EC2/SSHBruteForce` for an EC2 instance. The analyst checks CloudTrail and finds no API calls from the instance's role. What is the most appropriate immediate action to validate the finding and prevent further compromise?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Investigating AWS Environments GCTD Practice Questions (Page 6)

Questions 26–30

A Lambda function is suspected of being used to exfiltrate data. The analyst needs to determine what the function did and what permissions it used. Which two data sources should the analyst examine?

A security team wants to view security findings from GuardDuty, Security Hub, and Macie in a single dashboard. Which AWS service provides a centralized view of security findings across multiple AWS services?

An analyst is investigating a potential privilege escalation where an IAM user was added to an administrator group. The analyst needs to determine if the user actually used the new privileges. Which evidence would be most conclusive?

A security analyst is reviewing S3 access logs and notices a large number of GET requests from a single IP address. The analyst wants to determine if the requests were successful and if any objects were actually downloaded. Which fields in the S3 access log should the analyst examine?

A security analyst sees a GuardDuty finding of type `UnauthorizedAccess:EC2/SSHBruteForce` for an EC2 instance. The analyst checks CloudTrail and finds no API calls from the instance's role. What is the most appropriate immediate action to validate the finding and prevent further compromise?

Keep studying — Cloud Provider Investigations