An investigation reveals that a VM in a subnet is sending a large volume of data to an external IP. The NSG flow logs show that the traffic was allowed, but you need to determine whether the traffic was initiated by a legitimate application or by malware. You have access to the VM's resource logs, but they are not currently configured to capture process-level information. What is the most efficient next step?

Take a snapshot of the VM's disk and perform offline analysis to identify the process responsible for the traffic.

Query the Azure Activity Log for the VM to see if any suspicious extensions were installed.

Enable diagnostic settings on the VM to collect process-level logs (e.g., Sysmon or Auditd) and wait for new traffic to occur.

Use Azure Firewall logs to see if the traffic was blocked or allowed.

A security analyst is investigating a potential compromise in an Azure subscription. The analyst needs to determine which user stopped a critical VM and when, but the VM was deleted shortly after the stop. Which log source should the analyst query first to establish the timeline of control-plane actions?

Azure AD sign-in logs for the suspected user

Azure VM diagnostic logs from the deleted VM

Azure Activity Log for the subscription, filtered to the VM resource

Network Security Group flow logs for the VM's subnet

A user's account was compromised in the on-premises Active Directory, and the attacker used the same credentials to access Azure resources via Azure AD Connect. You need to trace the attacker's actions across both environments. You have access to on-premises AD logs and Azure AD sign-in logs. What is the best way to correlate the evidence?

Correlate the on-premises AD security logs with the Azure AD sign-in logs by user principal name and timestamp to identify the full attack path.

Check the Azure Activity Log for any resource operations performed by the user.

Use Azure Resource Graph to list all resources the user has access to.

Review the Azure AD audit log for directory changes made by the user.

An analyst needs to map network communications between virtual machines in a virtual network, including source and destination IPs and ports. Which Azure feature provides this information through flow logs?

Network Security Group (NSG) Flow Logs

GIAC Cloud Threat Detection

Domain 4Objective 2

Investigating Azure Environments GCTD Practice Questions (Page 4)

Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

14concepts

Questions 16–20

16foundation · easy
An investigator wants to identify Azure resources that are non-compliant with the organization's security policies. Which Azure service evaluates resources against policies and provides compliance data?
Select an answer first
17expert · hard
An investigation reveals that a VM in a subnet is sending a large volume of data to an external IP. The NSG flow logs show that the traffic was allowed, but you need to determine whether the traffic was initiated by a legitimate application or by malware. You have access to the VM's resource logs, but they are not currently configured to capture process-level information. What is the most efficient next step?
Select an answer first
18application · medium
A security analyst is investigating a potential compromise in an Azure subscription. The analyst needs to determine which user stopped a critical VM and when, but the VM was deleted shortly after the stop. Which log source should the analyst query first to establish the timeline of control-plane actions?
Select an answer first
19expert · hard
A user's account was compromised in the on-premises Active Directory, and the attacker used the same credentials to access Azure resources via Azure AD Connect. You need to trace the attacker's actions across both environments. You have access to on-premises AD logs and Azure AD sign-in logs. What is the best way to correlate the evidence?
Select an answer first
20foundation · easy
An analyst needs to map network communications between virtual machines in a virtual network, including source and destination IPs and ports. Which Azure feature provides this information through flow logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Investigating Azure Environments GCTD Practice Questions (Page 4)

Questions 16–20

An investigator wants to identify Azure resources that are non-compliant with the organization's security policies. Which Azure service evaluates resources against policies and provides compliance data?

An analyst needs to map network communications between virtual machines in a virtual network, including source and destination IPs and ports. Which Azure feature provides this information through flow logs?

Keep studying — Cloud Provider Investigations