An incident responder needs to capture a snapshot of an EC2 instance's memory for forensic analysis. Which AWS feature is designed for this purpose?

EC2 instance snapshot with memory

A security team wants to automatically suppress low-severity GuardDuty findings from being sent to the incident response team. They use Security Hub. Which feature of Security Hub should they use?

Finding filters and suppression rules

A security analyst needs to identify all EC2 instances that have communicated with a known malicious IP address in the last 24 hours. The analyst has VPC Flow Logs and CloudTrail logs in CloudWatch Logs. Which query would be most efficient?

Query both VPC Flow Logs and CloudTrail logs and merge the results

Query GuardDuty findings for the malicious IP

Query CloudTrail logs for API calls from the malicious IP

Query VPC Flow Logs for the malicious IP as source or destination

A security analyst is performing forensic analysis on a compromised EC2 instance. The instance is still running, and the analyst needs to preserve volatile data before taking a snapshot. Which step should be performed first?

Copy the instance's CloudWatch logs to a secure bucket

Detach the EBS volumes and attach them to a forensic instance

Create a snapshot of the EBS volumes

Collect memory and process information from the instance

An organization requires that all changes to IAM policies be reviewed for compliance. A security engineer notices that a critical S3 bucket policy was changed, but the change is not reflected in AWS Config. What is the most likely reason for this gap?

The change was made by the bucket owner using the AWS Management Console

AWS Config does not record changes to S3 bucket policies

CloudTrail is not enabled for S3 data events

The S3 bucket is not in the AWS Config recording region

GIAC Cloud Threat Detection

Domain 4Objective 1

Investigating AWS Environments GCTD Practice Questions (Page 9)

Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 41–45

41foundation · easy
An incident responder needs to capture a snapshot of an EC2 instance's memory for forensic analysis. Which AWS feature is designed for this purpose?
Select an answer first
42application · medium
A security team wants to automatically suppress low-severity GuardDuty findings from being sent to the incident response team. They use Security Hub. Which feature of Security Hub should they use?
Select an answer first
43expert · hard
A security analyst needs to identify all EC2 instances that have communicated with a known malicious IP address in the last 24 hours. The analyst has VPC Flow Logs and CloudTrail logs in CloudWatch Logs. Which query would be most efficient?
Select an answer first
44application · medium
A security analyst is performing forensic analysis on a compromised EC2 instance. The instance is still running, and the analyst needs to preserve volatile data before taking a snapshot. Which step should be performed first?
Select an answer first
45application · medium
An organization requires that all changes to IAM policies be reviewed for compliance. A security engineer notices that a critical S3 bucket policy was changed, but the change is not reflected in AWS Config. What is the most likely reason for this gap?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.