GIAC Cloud Threat Detection
Domain 4Objective 1
Investigating AWS Environments GCTD Practice Questions (Page 7)
Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)
48questions here
10free pages
10concepts
Questions 31–35
- 31
A security analyst is investigating a possible data breach involving an S3 bucket. The analyst has S3 access logging enabled and needs to identify whether an unauthorized user downloaded objects. Which field in the S3 access log should the analyst focus on to identify the requester?
Select an answer first - 32
An incident responder needs to determine which API calls were made by a specific IAM user in an AWS account during a suspected compromise. Which AWS service provides a detailed record of API activity for this investigation?
Select an answer first - 33
During a Lambda function investigation, an analyst wants to review the IAM role that the function uses to access other AWS resources. Which part of the Lambda function configuration contains this information?
Select an answer first - 34
A security analyst receives a GuardDuty finding that indicates a potential threat. What is the primary purpose of the finding's 'severity' field?
Select an answer first - 35
A security analyst is investigating a potential privilege escalation path. An IAM role `app-role` has a policy that allows `iam:PassRole` on any role and `ec2:RunInstances` on any instance. CloudTrail shows that `app-role` was used to launch an EC2 instance with a role that has `AdministratorAccess`. What is the most likely impact of this activity?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.