A security alert indicates that a container in an AKS cluster is running a cryptocurrency miner. You need to confirm the alert and identify which pod and namespace are affected. Which two data sources should you examine?

ARM template deployment history and Azure Policy compliance data

Pod logs and AKS cluster events

Azure AD sign-in logs and Azure Key Vault logs

Azure Activity Log and NSG flow logs

You suspect that a user has more permissions than necessary after a recent incident. You need to review all role assignments for that user across the subscription. Which tool should you use?

Azure Resource Graph: query for role assignments

Azure CLI: az role assignment list --assignee --all

Azure Activity Log: filter for 'Microsoft.Authorization/roleAssignments/write'

Azure AD audit log: filter for 'Add member to role'

During an investigation, you need to determine which user stopped a critical VM in the 'prod-eastus' resource group and whether that user had the required permission. You have access to the Azure portal. What is the most efficient way to gather this evidence?

Check the Azure AD sign-in logs for the user who last authenticated to the Azure portal, then correlate that time with the VM deallocation time.

Use Azure Resource Graph to list all VM resources in the subscription and check the 'owner' tag to identify who stopped the VM.

Review the VM's resource log (diagnostic setting) for the deallocation event, which includes the user principal name and IP address of the caller.

Query the Azure Activity Log for the resource group, filtering for the 'Microsoft.Compute/virtualMachines/deallocate/action' operation, and review the 'Initiated by' and 'Authorization' properties.

During an incident, you need to determine whether a VM was compliant with the organization's policy requiring the latest OS patches. The VM was recently created, and you suspect that the policy was not applied. You have access to Azure Policy compliance data and the VM's resource logs. What is the best way to confirm this?

Use Azure Resource Graph to query the VM's tags for a 'patch' tag.

Check the Azure Policy compliance data for the VM to see if it is non-compliant for the patch policy.

Check the Azure Activity Log for the VM to see if the policy assignment was created.

Review the VM's resource logs to see if Windows Update ran successfully.

GIAC Cloud Threat Detection

Domain 4Objective 2

Investigating Azure Environments GCTD Practice Questions (Page 8)

Part of the Cloud Provider Investigations domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

14concepts

Questions 36–40

36foundation · easy
An analyst needs to monitor who is retrieving secrets from an Azure Key Vault. Which log should be enabled and analyzed?
Select an answer first
37application · medium
A security alert indicates that a container in an AKS cluster is running a cryptocurrency miner. You need to confirm the alert and identify which pod and namespace are affected. Which two data sources should you examine?
Select an answer first
38application · medium
You suspect that a user has more permissions than necessary after a recent incident. You need to review all role assignments for that user across the subscription. Which tool should you use?
Select an answer first
39application · medium
During an investigation, you need to determine which user stopped a critical VM in the 'prod-eastus' resource group and whether that user had the required permission. You have access to the Azure portal. What is the most efficient way to gather this evidence?
Select an answer first
40expert · hard
During an incident, you need to determine whether a VM was compliant with the organization's policy requiring the latest OS patches. The VM was recently created, and you suspect that the policy was not applied. You have access to Azure Policy compliance data and the VM's resource logs. What is the best way to confirm this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Investigating Azure Environments GCTD Practice Questions (Page 8)

Questions 36–40

An analyst needs to monitor who is retrieving secrets from an Azure Key Vault. Which log should be enabled and analyzed?

A security alert indicates that a container in an AKS cluster is running a cryptocurrency miner. You need to confirm the alert and identify which pod and namespace are affected. Which two data sources should you examine?

You suspect that a user has more permissions than necessary after a recent incident. You need to review all role assignments for that user across the subscription. Which tool should you use?

During an investigation, you need to determine which user stopped a critical VM in the 'prod-eastus' resource group and whether that user had the required permission. You have access to the Azure portal. What is the most efficient way to gather this evidence?

Keep studying — Cloud Provider Investigations