An analyst notices a spike in failed logins to a web application, followed by a successful login from an unusual IP, and then a large data download. The logs are in a central SIEM. What is the most effective way to confirm this is a single attack campaign?

Manually review each log entry in chronological order to see if they seem related.

Block the unusual IP address at the firewall immediately.

Create a correlation rule that joins authentication logs with network logs based on user, IP, and time window.

Search for all events from the unusual IP in the last 24 hours.

GIAC Cloud Threat Detection

Domain 1Objective 2

Log Centralization GCTD Practice Questions (Page 10)

Part of the Cloud Monitoring Foundations domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 46–46

46application · medium
An analyst notices a spike in failed logins to a web application, followed by a successful login from an unusual IP, and then a large data download. The logs are in a central SIEM. What is the most effective way to confirm this is a single attack campaign?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Log Centralization GCTD Practice Questions (Page 10)

Questions 46–46

An analyst notices a spike in failed logins to a web application, followed by a successful login from an unusual IP, and then a large data download. The logs are in a central SIEM. What is the most effective way to confirm this is a single attack campaign?

Keep studying — Cloud Monitoring Foundations