GIAC Cloud Threat Detection
Domain 4Objective 2
Investigating Azure Environments GCTD Practice Questions (Page 7)
Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)
55questions here
11free pages
14concepts
Questions 31–35
- 31
An analyst is reviewing Azure deployment history to identify when a suspicious resource was deployed. Which Azure service records the history of ARM template deployments?
Select an answer first - 32
A company stores sensitive data in an Azure Storage account and uses Azure Key Vault for encryption keys. An alert indicates that a large number of 'GetBlob' operations occurred from an unusual IP address. You need to determine whether the data was actually read and whether the encryption keys were accessed. You have access to both storage resource logs and Key Vault audit logs. What is the best approach?
Select an answer first - 33
To analyze resource logs from an Azure Storage account, where must the analyst first enable diagnostic settings?
Select an answer first - 34
Which Azure AD log would an analyst use to determine if a user's password was changed or if a new user account was created?
Select an answer first - 35
A security team discovers that a storage account has been publicly accessible for weeks, and a Defender for Cloud alert flagged it. The team needs to determine whether the public access was intentional, whether any data was accessed, and whether other resources are similarly misconfigured. The team has limited time and must prioritize. Which approach provides the most comprehensive answer?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.