GIAC Cloud Threat Detection
Domain 4Objective 2
Investigating Azure Environments GCTD Practice Questions (Page 6)
Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)
55questions here
11free pages
14concepts
Questions 26–30
- 26
An analyst needs to determine who created a new virtual machine in an Azure subscription and when that creation occurred. Which Azure log should the analyst query to find this control-plane operation?
Select an answer first - 27
During an investigation, you need to determine whether a VM is compliant with the organization's requirement to have encryption at rest enabled. Which Azure service should you use to quickly assess this?
Select an answer first - 28
A security analyst is investigating a suspected account compromise. Defender for Cloud alerts show a sign-in from an anomalous location, and the Activity Log shows the account created a new role assignment. The analyst must determine whether the role assignment was actually used to access sensitive data. The environment has Sentinel enabled, but the analyst has limited time. What is the most efficient next step?
Select an answer first - 29
When investigating a hybrid environment, which Azure service can help connect on-premises network logs with Azure network logs for a unified view?
Select an answer first - 30
An analyst is investigating a potential data exfiltration from an Azure Storage account. The team needs to know which files were accessed, from which IP addresses, and whether the access was anonymous or authenticated. Which log source provides this data-plane activity?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.