Network and Flow Monitoring GCTD Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company runs a web application behind an Application Load Balancer (ALB) in AWS. The security team wants to detect attempts to exploit a specific web application vulnerability by analyzing HTTP request patterns. Which data source should they use?

   • AAWS Config, because it tracks configuration changes to the load balancer
   • BALB access logs, because they contain detailed HTTP request information including URLs, headers, and response codes
   • CVPC Flow Logs, because they contain the full HTTP payload
   • DCloudTrail logs, because they record all HTTP requests to the load balancer
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of network monitoring in a cloud environment?

   • ATo observe and analyze network traffic to detect anomalies, support security investigations, and ensure operational health
   • BTo store every packet of network traffic for long-term compliance
   • CTo block all malicious traffic before it reaches the network perimeter
   • DTo replace the need for security information and event management (SIEM) tools
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is investigating a potential data breach in a cloud environment. The analyst needs to determine which internal resources communicated with a known malicious external IP address over the past 30 days. Which data source would be most effective for this investigation?

   • AVPC Flow Logs, because they record all network traffic metadata including source and destination IPs
   • BLoad balancer access logs, because they record all traffic to and from the load balancer
   • CCloudTrail logs, because they record all API calls made by internal resources
   • DPacket captures from a single instance, because they provide full payload data
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC team is integrating VPC flow logs with their SIEM. They want to detect beaconing activity, which is characterized by regular, periodic connections to an external IP. They have enabled flow logs with a 10-minute aggregation interval. Which of the following is the most significant limitation of this configuration for detecting beaconing?

   • AThe flow logs do not include the protocol.
   • BThe 10-minute interval may aggregate multiple beacon connections into a single flow record, obscuring the periodic pattern.
   • CThe flow logs do not include the destination IP.
   • DThe flow logs are not delivered to the SIEM in real time.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a primary source of network flow data in a cloud platform?

   • ACost management reports
   • BCloud trail logs
   • CDNS resolver logs
   • DVPC flow logs
   Reveal Solution Discussion Select an answer first