Network and Flow Monitoring GCTD Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is investigating a potential data exfiltration from a compromised EC2 instance. The VPC flow logs show a connection from the instance to an external IP on port 443, with a total of 500 MB transferred over 30 minutes. The analyst also has the instance's system logs, which show no unusual processes. Which additional data source would best help determine if the data was actually exfiltrated?

   • AThe instance's system logs.
   • BThe flow logs' byte count.
   • CCloudTrail logs for the instance.
   • DPacket captures from the instance's ENI.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is reviewing VPC flow logs and notices a pattern: an internal server is communicating with an external IP on port 22 (SSH) at regular intervals, each connection lasting only a few seconds and transferring minimal data. This pattern has been occurring for several days. Which analysis technique would best help determine if this is malicious?

   • ADisable flow logging for that server to reduce noise.
   • BIncrease the flow log aggregation interval to 10 minutes to get more data per log.
   • CCheck the flow logs for the destination port and protocol only.
   • DCorrelate the flow log entries with authentication logs from the server to see if successful logins occurred.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security operations center (SOC) uses a SIEM platform for centralized monitoring. They have enabled VPC flow logs for all VPCs in their cloud environment and want to ensure the flow logs are ingested into the SIEM for correlation with other security events. Which integration approach is most appropriate?

   • AStore flow logs only in the cloud provider's native log service and query them there.
   • BConfigure the flow logs to be delivered to a central log bucket and use a SIEM collector to ingest from that bucket.
   • CDisable flow logs and rely on the SIEM to collect network traffic directly.
   • DHave each VPC send flow logs directly to the SIEM via syslog.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which cloud resource logs are specifically designed to capture metadata about traffic through a central network hub?

   • ATransit gateway logs
   • BObject storage access logs
   • CIdentity and access management (IAM) logs
   • DDatabase query logs
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a common use of flow log analysis in threat detection?

   • AAutomatically blocking malicious IP addresses
   • BReplacing the need for endpoint detection and response (EDR) tools
   • CDecrypting SSL/TLS traffic to read the contents of communications
   • DIdentifying communication patterns that indicate data exfiltration, such as large outbound transfers to an unusual destination
   Reveal Solution Discussion Select an answer first