A company uses Azure AD Connect to sync identities. An incident involves a user account that was created on-premises and then used to access a VM in Azure. The on-premises domain controller logs have been lost, but Azure AD sign-in logs show the account's authentication. The analyst needs to determine whether the account was created by an attacker or by a legitimate admin. Which approach is most likely to provide evidence?

Examine the Azure AD audit logs for the account's creation and sync events

Review the Azure Activity Log for the VM's creation

Analyze the VM's local logs for the account's login activity

Use Azure Policy compliance data

An investigator is tracing a user's activity that spans an on-premises network and multiple Azure tenants. Which approach is essential for correlating evidence across these environments?

Reviewing each environment's logs separately without correlation

Relying solely on Azure AD Sign-in Logs

Centralizing logs from all environments into a single SIEM such as Microsoft Sentinel

A company uses a hybrid identity model with Azure AD Connect. An incident involves a user account that was created on-premises and then used to access Azure resources. The investigation must trace the account creation and subsequent Azure sign-ins. Which log sources should be correlated?

Azure Activity Log and Azure resource logs

Azure AD audit logs and Azure AD sign-in logs

On-premises Active Directory event logs and Azure AD sign-in logs

Azure Key Vault audit logs and storage logs

GIAC Cloud Threat Detection

Domain 4Objective 2

Investigating Azure Environments GCTD Practice Questions (Page 10)

Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

14concepts

Questions 46–50

46foundation · easy
An investigator wants to identify who accessed a specific blob in an Azure Storage account and what actions they performed. Which log should be examined?
Select an answer first
47expert · hard
A company uses Azure AD Connect to sync identities. An incident involves a user account that was created on-premises and then used to access a VM in Azure. The on-premises domain controller logs have been lost, but Azure AD sign-in logs show the account's authentication. The analyst needs to determine whether the account was created by an attacker or by a legitimate admin. Which approach is most likely to provide evidence?
Select an answer first
48foundation · easy
An investigator is tracing a user's activity that spans an on-premises network and multiple Azure tenants. Which approach is essential for correlating evidence across these environments?
Select an answer first
49foundation · easy
In the Azure Activity Log, which field indicates the specific action that was performed, such as 'Microsoft.Compute/virtualMachines/write'?
Select an answer first
50application · medium
A company uses a hybrid identity model with Azure AD Connect. An incident involves a user account that was created on-premises and then used to access Azure resources. The investigation must trace the account creation and subsequent Azure sign-ins. Which log sources should be correlated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Investigating Azure Environments GCTD Practice Questions (Page 10)

Questions 46–50

An investigator wants to identify who accessed a specific blob in an Azure Storage account and what actions they performed. Which log should be examined?

An investigator is tracing a user's activity that spans an on-premises network and multiple Azure tenants. Which approach is essential for correlating evidence across these environments?

In the Azure Activity Log, which field indicates the specific action that was performed, such as 'Microsoft.Compute/virtualMachines/write'?

A company uses a hybrid identity model with Azure AD Connect. An incident involves a user account that was created on-premises and then used to access Azure resources. The investigation must trace the account creation and subsequent Azure sign-ins. Which log sources should be correlated?

Keep studying — Cloud Provider Investigations