An AKS cluster has a pod that is making outbound connections to a known command-and-control IP. The cluster uses Azure Policy to enforce pod security standards, but the policy is in audit mode. The security team needs to determine whether the pod's service account has excessive permissions and whether other pods are affected. Which investigation path is most efficient?

Review Azure Policy compliance data for the cluster

Examine the pod's service account role bindings, then query network flow logs for other pods connecting to the same IP

Check the Azure Activity Log for the cluster

Use Defender for Cloud alerts only

You discover that a new user with 'Owner' permissions was created in a subscription, but the Azure AD audit log shows no user creation event. You suspect that the user was created via an ARM template deployment. You need to confirm this and identify the template. The deployment history has been retained for 90 days. What is the best approach?

Review the NSG flow logs for the management subnet to see if any suspicious API calls were made.

Check the Azure AD audit log for 'Add user' events, even though you already know none exist.

Use Azure Resource Graph to search for the user object in the subscription.

Review the deployment history in the subscription, focusing on deployments that include 'Microsoft.Authorization/roleAssignments' and 'Microsoft.AzureActiveDirectory/b2cDirectories' or similar resources.

To perform forensic analysis on an Azure VM without altering the original, which action should an investigator take first?

Create a snapshot of the OS and data disks

An analyst needs to review all role assignments in an Azure subscription to identify users with administrative privileges. Which Azure service provides a centralized view of role assignments?

Azure RBAC (Role-Based Access Control)

Which of the following is a common indicator of data exfiltration from an Azure Storage account that an analyst might look for in storage logs?

A periodic health check from a known monitoring service

A single failed authentication attempt

A large number of successful read requests for a specific blob from an unusual IP address

GIAC Cloud Threat Detection

Domain 4Objective 2

Investigating Azure Environments GCTD Practice Questions (Page 5)

Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

14concepts

Questions 21–25

21expert · hard
An AKS cluster has a pod that is making outbound connections to a known command-and-control IP. The cluster uses Azure Policy to enforce pod security standards, but the policy is in audit mode. The security team needs to determine whether the pod's service account has excessive permissions and whether other pods are affected. Which investigation path is most efficient?
Select an answer first
22expert · hard
You discover that a new user with 'Owner' permissions was created in a subscription, but the Azure AD audit log shows no user creation event. You suspect that the user was created via an ARM template deployment. You need to confirm this and identify the template. The deployment history has been retained for 90 days. What is the best approach?
Select an answer first
23foundation · easy
To perform forensic analysis on an Azure VM without altering the original, which action should an investigator take first?
Select an answer first
24foundation · easy
An analyst needs to review all role assignments in an Azure subscription to identify users with administrative privileges. Which Azure service provides a centralized view of role assignments?
Select an answer first
25foundation · easy
Which of the following is a common indicator of data exfiltration from an Azure Storage account that an analyst might look for in storage logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Investigating Azure Environments GCTD Practice Questions (Page 5)

Questions 21–25

To perform forensic analysis on an Azure VM without altering the original, which action should an investigator take first?

An analyst needs to review all role assignments in an Azure subscription to identify users with administrative privileges. Which Azure service provides a centralized view of role assignments?

Which of the following is a common indicator of data exfiltration from an Azure Storage account that an analyst might look for in storage logs?

Keep studying — Cloud Provider Investigations