Network and Flow Monitoring GCTD Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company has enabled VPC Flow Logs and is delivering them to CloudWatch Logs. The security team is not seeing any flow logs for a specific network interface, even though other interfaces in the same VPC are logging correctly. The flow log status is 'ACTIVE'. What is the most likely cause?

   • AThe network interface is not attached to a running instance
   • BThe IAM role does not have permissions for that interface
   • CThe flow log is not enabled on that specific network interface
   • DThe CloudWatch Logs log group is full
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A cloud administrator enabled VPC flow logs for a new VPC, but after 24 hours, no flow log files have been delivered to the designated S3 bucket. The flow log configuration shows as 'Active'. What is the most likely cause of this issue?

   • AThe VPC does not have any network traffic to log.
   • BThe flow log aggregation interval is set to 10 minutes, so logs are delayed.
   • CThe flow log is configured to capture only rejected traffic, and there is no rejected traffic.
   • DThe IAM role used by the flow log does not have permission to write to the S3 bucket.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security operations center (SOC) uses a SIEM platform for centralized monitoring. They have enabled VPC Flow Logs in AWS and want to ensure the flow log data is available in the SIEM for correlation with other security events. What is the most efficient way to achieve this?

   • AStream the flow logs from CloudWatch Logs to the SIEM using a subscription filter
   • BEnable flow logs directly on the SIEM's network interface
   • CUse AWS CloudTrail to deliver flow logs to the SIEM
   • DManually download the flow log files from S3 and upload them to the SIEM daily
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A cloud security team is designing a monitoring strategy for a multi-account AWS environment. They need to detect lateral movement between EC2 instances in different VPCs that are connected via a transit gateway. Which data sources should they prioritize for this detection?

   • AOnly VPC Flow Logs, because they capture all traffic including transit gateway traffic
   • BOnly Transit Gateway Network Manager flow logs, because they capture all traffic between VPCs
   • CTransit Gateway Network Manager flow logs and VPC Flow Logs
   • DAWS CloudTrail and VPC Flow Logs
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is investigating a potential data exfiltration from an application running on EC2 instances behind an Application Load Balancer (ALB). The analyst needs to determine if the exfiltration occurred through the load balancer or directly from the instances. Which combination of log sources would provide the most complete picture?

   • AVPC flow logs for the instances' subnets and ALB access logs.
   • BOnly VPC flow logs for the VPC.
   • CCloudTrail logs for the EC2 instances.
   • DOnly ALB access logs.
   Reveal Solution Discussion Select an answer first