Network and Flow Monitoring GCTD Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security architect is designing a monitoring solution for a multi-account cloud environment. They need to capture network flow data across all VPCs and on-premises connections via a transit gateway. Which approach provides the most comprehensive flow data?

   • AEnable VPC flow logs on all VPCs and transit gateway flow logs.
   • BEnable only VPC flow logs on the VPCs that connect to the transit gateway.
   • CUse AWS CloudTrail to capture network traffic.
   • DEnable only transit gateway flow logs.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a common issue when analyzing flow log data?

   • AFlow logs are encrypted and cannot be read by any tool
   • BFlow logs contain too much detail, making them impossible to store
   • CFlow logs only contain data from the last 24 hours
   • DThe log format changes unexpectedly, causing parsing errors in the monitoring tool
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which type of data is typically collected by network monitoring in a cloud environment?

   • AMetadata about network flows, such as source and destination IP addresses, ports, and protocols
   • BOnly the payload of application-layer protocols like HTTP and DNS
   • COnly the number of bytes transferred per day, without any other details
   • DThe full content of every packet traversing the network
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When configuring flow log collection for a cloud network resource, what does the capture interval determine?

   • AThe number of network interfaces that are monitored
   • BThe encryption algorithm used for log delivery
   • CThe maximum size of each flow log record
   • DHow often flow log records are aggregated and delivered to the destination
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security operations center (SOC) is integrating VPC Flow Logs into their SIEM. They have a requirement to detect anomalies in real-time and also to support historical investigations. The SIEM has limited processing capacity, and the team wants to minimize the volume of data sent to the SIEM while still capturing all relevant traffic. What approach should they take?

   • AUse a Lambda function to filter flow logs for only high-risk traffic (e.g., rejected connections, unusual ports) and send only those to the SIEM
   • BStore all flow logs in S3 and only send a summary report to the SIEM daily
   • CSend all flow logs to the SIEM and rely on the SIEM's correlation rules to detect anomalies
   • DDisable flow logs and rely on the SIEM's built-in network sensors
   Reveal Solution Discussion Select an answer first