A company's security team is investigating a potential data exfiltration from an EC2 instance. VPC Flow Logs show sustained outbound traffic from the instance to an IP address in a foreign country on port 443. CloudTrail shows no unusual API calls from the instance's role. Which additional step would most directly confirm whether the traffic is encrypted data exfiltration or legitimate HTTPS traffic?

Capture and analyze the instance's network packets using VPC Traffic Mirroring

Review CloudWatch Logs Insights on the instance's OS-level logs for outbound connections to that IP

Check AWS Config for changes to the instance's security group

Query GuardDuty for a finding related to the foreign IP

A security engineer is investigating a change to an S3 bucket policy that granted public read access. AWS Config shows the change, but CloudTrail does not show the `PutBucketPolicy` API call. What is the most likely explanation?

CloudTrail is not recording data events for the S3 bucket

The change was made by the bucket owner using the AWS Management Console

CloudTrail is not enabled in the region where the bucket is located

The change was made using the S3 API directly, bypassing CloudTrail

GuardDuty generates a finding for 'UnauthorizedAccess:IAMUser/ConsoleLoginSuccess' for a user who typically logs in from a specific IP. The analyst needs to verify if the login was truly unauthorized. Which two data sources should the analyst examine?

CloudWatch Logs Insights and GuardDuty findings

S3 access logs and Security Hub

CloudTrail for the console login event and the user's IAM policy

GIAC Cloud Threat Detection

Domain 4Objective 1

Investigating AWS Environments GCTD Practice Questions (Page 8)

Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 36–40

36application · medium
A company's security team is investigating a potential data exfiltration from an EC2 instance. VPC Flow Logs show sustained outbound traffic from the instance to an IP address in a foreign country on port 443. CloudTrail shows no unusual API calls from the instance's role. Which additional step would most directly confirm whether the traffic is encrypted data exfiltration or legitimate HTTPS traffic?
Select an answer first
37foundation · easy
An investigator wants to see the output of a Lambda function that may have been invoked maliciously. Which AWS service stores the logs generated by Lambda function executions?
Select an answer first
38foundation · easy
Which IAM entity is a collection of permissions that can be assumed by a user, service, or application to obtain temporary credentials?
Select an answer first
39expert · hard
A security engineer is investigating a change to an S3 bucket policy that granted public read access. AWS Config shows the change, but CloudTrail does not show the `PutBucketPolicy` API call. What is the most likely explanation?
Select an answer first
40application · medium
GuardDuty generates a finding for 'UnauthorizedAccess:IAMUser/ConsoleLoginSuccess' for a user who typically logs in from a specific IP. The analyst needs to verify if the login was truly unauthorized. Which two data sources should the analyst examine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Investigating AWS Environments GCTD Practice Questions (Page 8)

Questions 36–40

An investigator wants to see the output of a Lambda function that may have been invoked maliciously. Which AWS service stores the logs generated by Lambda function executions?

Which IAM entity is a collection of permissions that can be assumed by a user, service, or application to obtain temporary credentials?

A security engineer is investigating a change to an S3 bucket policy that granted public read access. AWS Config shows the change, but CloudTrail does not show the `PutBucketPolicy` API call. What is the most likely explanation?

GuardDuty generates a finding for 'UnauthorizedAccess:IAMUser/ConsoleLoginSuccess' for a user who typically logs in from a specific IP. The analyst needs to verify if the login was truly unauthorized. Which two data sources should the analyst examine?

Keep studying — Cloud Provider Investigations