Network and Flow Monitoring GCTD Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is a common cause of missing flow log data in a cloud environment?

   • AThe flow log feature is only available for a limited trial period
   • BThe flow log destination bucket or stream was deleted or permissions were misconfigured
   • CThe network is too fast for flow logs to capture traffic
   • DFlow logs only capture traffic during business hours
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A network engineer notices that VPC flow logs are being delivered to S3, but some log files are missing for certain time periods. The engineer suspects the flow log delivery is intermittent. What is the most likely cause?

   • AThe S3 bucket policy is misconfigured.
   • BThe VPC had no traffic during those periods.
   • CThe flow log aggregation interval is set to 10 minutes, so logs are delayed.
   • DThe flow log delivery service experienced throttling or transient failures.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst notices that VPC flow logs are being delivered to S3, but the SIEM is not ingesting them. The S3 bucket is receiving new files, but the SIEM collector is not picking them up. What is the most likely cause?

   • AThe S3 bucket is in a different region than the SIEM.
   • BThe flow logs are in the wrong format.
   • CThe flow log aggregation interval is too long.
   • DThe SIEM collector does not have permission to read from the S3 bucket.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security analyst is comparing flow logs and packet captures for a cloud workload. The analyst needs to identify which approach is more suitable for detecting a slow, long-running data exfiltration that transfers small amounts of data over an extended period. Which approach should the analyst choose?

   • ABoth are equally effective, so the analyst should use either one
   • BPacket captures, because they provide full payload visibility for every packet
   • CFlow logs, because they provide aggregated metadata that can reveal long-duration flows and cumulative byte counts
   • DNeither, because network monitoring cannot detect slow data exfiltration
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security analyst is investigating a potential data exfiltration incident. The analyst has VPC Flow Logs and notices a flow from an internal EC2 instance to an external IP address on port 443, with a total of 500 MB of data transferred over a 2-hour period. The analyst also sees that the flow has a 'ACCEPT' status. However, the analyst is unsure whether the data was actually sensitive. What additional data source would best help confirm the exfiltration?

   • AThe flow log's byte count, because it indicates the amount of data transferred
   • BAWS Config rules for the EC2 instance
   • CPacket capture from the EC2 instance during the same time period
   • DCloudTrail logs for the EC2 instance
   Reveal Solution Discussion Select an answer first