A company's data is stored in a public cloud region in a country with strict data residency laws. During an incident, the IR team needs to analyze logs that are stored in a different region. What is the primary legal consideration?

Whether the cloud provider has a SOC 2 report

Whether the logs are encrypted at rest

Whether the logs are stored in a private cloud

Whether transferring the logs across regions violates data residency regulations

During an incident in GCP, the IR team needs to determine which IAM roles a compromised Compute Engine instance was using. Which source provides this information?

Cloud Audit Logs for the instance

Instance metadata server (metadata.google.internal)

An organization uses AWS with VPC Flow Logs enabled for all VPCs. During an incident, the responder needs to identify which external IP addresses communicated with a compromised EC2 instance over the past 48 hours. Which approach is most efficient?

Use AWS CloudTrail to review EC2 API calls.

Query the VPC Flow Logs in CloudWatch Logs Insights for the instance's network interface.

Log into the instance and run 'netstat' to see active connections.

Enable AWS Network Firewall and review its logs.

A Kubernetes pod is compromised. The responder needs to determine what commands were executed inside the container. The container is still running. Which source provides the most complete record of executed commands?

The container runtime's JSON logs (e.g., Docker's json-file log driver).

The container's filesystem, including shell history files.

The Kubernetes audit logs for 'exec' commands.

The node's systemd journal for the container's PID.

GIAC Enterprise Incident Responder

Domain 2Objective 2

Cloud Response and Analysis GEIR Practice Questions (Page 1)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 1–5

1expert · hard
A company's data is stored in a public cloud region in a country with strict data residency laws. During an incident, the IR team needs to analyze logs that are stored in a different region. What is the primary legal consideration?
Select an answer first
2application · medium
During an incident in GCP, the IR team needs to determine which IAM roles a compromised Compute Engine instance was using. Which source provides this information?
Select an answer first
3application · medium
An organization uses AWS with VPC Flow Logs enabled for all VPCs. During an incident, the responder needs to identify which external IP addresses communicated with a compromised EC2 instance over the past 48 hours. Which approach is most efficient?
Select an answer first
4foundation · easy
In the cloud incident response lifecycle, which phase involves removing the root cause of the incident, such as deleting malicious files or disabling compromised user accounts?
Select an answer first
5expert · hard
A Kubernetes pod is compromised. The responder needs to determine what commands were executed inside the container. The container is still running. Which source provides the most complete record of executed commands?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.