A database administrator notices unusual queries running against an Azure SQL database. The security team needs to determine whether these queries were part of an attack and whether any data was exported. Which log source should be analyzed to see the actual query text and the client IP?

Azure Activity Log for the SQL server

NSG flow logs for the database subnet

During an incident, an analyst must quickly identify all resources that were created or modified in the last 24 hours across multiple subscriptions. The analyst needs a single view that lists resources and their change history. Which approach provides the most efficient baseline?

Use Azure Policy compliance data

Use Azure Resource Graph to query resources across subscriptions, then correlate with Activity Log for changes

Query each subscription's Activity Log separately

A security team is reviewing an incident where a user with Contributor role on a subscription created a new role assignment granting themselves Owner. The team needs to identify when the role assignment was created and by whom. Which log source should be examined?

Azure resource logs for the subscription

Azure Activity Log, filtering for 'Create role assignment'

A security incident involves the theft of secrets from Azure Key Vault. You need to determine whether the secrets were accessed by an authorized application or by an attacker who compromised the application's credentials. You have access to Key Vault audit logs and Azure AD sign-in logs. What is the best way to distinguish between the two?

Check the Azure Activity Log for the Key Vault to see if the access policy was changed.

Correlate the Key Vault audit logs with the Azure AD sign-in logs for the application's service principal, checking for anomalies such as unusual IP addresses or failed sign-ins.

Use Azure Resource Graph to check the Key Vault's network ACLs.

Review the Key Vault audit logs alone to see the caller IP addresses.

GIAC Cloud Threat Detection

Domain 4Objective 2

Investigating Azure Environments GCTD Practice Questions (Page 1)

Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

14concepts

Questions 1–5

1application · medium
A database administrator notices unusual queries running against an Azure SQL database. The security team needs to determine whether these queries were part of an attack and whether any data was exported. Which log source should be analyzed to see the actual query text and the client IP?
Select an answer first
2foundation · easy
During an Azure incident investigation, an analyst needs to establish a complete inventory of all cloud resources that exist across the organization's subscriptions. Which Azure service provides a centralized, queryable view of all resources across subscriptions, resource groups, and regions?
Select an answer first
3application · medium
During an incident, an analyst must quickly identify all resources that were created or modified in the last 24 hours across multiple subscriptions. The analyst needs a single view that lists resources and their change history. Which approach provides the most efficient baseline?
Select an answer first
4application · medium
A security team is reviewing an incident where a user with Contributor role on a subscription created a new role assignment granting themselves Owner. The team needs to identify when the role assignment was created and by whom. Which log source should be examined?
Select an answer first
5expert · hard
A security incident involves the theft of secrets from Azure Key Vault. You need to determine whether the secrets were accessed by an authorized application or by an attacker who compromised the application's credentials. You have access to Key Vault audit logs and Azure AD sign-in logs. What is the best way to distinguish between the two?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Investigating Azure Environments GCTD Practice Questions (Page 1)

Questions 1–5

A database administrator notices unusual queries running against an Azure SQL database. The security team needs to determine whether these queries were part of an attack and whether any data was exported. Which log source should be analyzed to see the actual query text and the client IP?

During an Azure incident investigation, an analyst needs to establish a complete inventory of all cloud resources that exist across the organization's subscriptions. Which Azure service provides a centralized, queryable view of all resources across subscriptions, resource groups, and regions?

During an incident, an analyst must quickly identify all resources that were created or modified in the last 24 hours across multiple subscriptions. The analyst needs a single view that lists resources and their change history. Which approach provides the most efficient baseline?

A security team is reviewing an incident where a user with Contributor role on a subscription created a new role assignment granting themselves Owner. The team needs to identify when the role assignment was created and by whom. Which log source should be examined?

Keep studying — Cloud Provider Investigations