A compromised Azure VM is sending outbound phishing emails. The IR team needs to contain the threat while preserving the ability to analyze the VM's disk. Which containment action should they take?

Apply a network security group (NSG) rule to block outbound SMTP traffic

Rotate the VM's managed identity credentials

Stop the VM from the Azure portal

Which piece of cloud instance metadata is most likely to be targeted by an attacker to escalate privileges?

The instance's public IP address

The IAM role associated with the instance

The instance's security group rules

A multinational company uses a SaaS application (e.g., Microsoft 365) and suspects an insider exfiltrated data. The incident responder needs to preserve evidence for potential legal action. The data is stored in a region outside the company's home country. Which consideration is MOST critical when acquiring evidence?

Ensure the evidence acquisition method complies with local data protection and cross-border transfer laws.

Take a snapshot of the underlying virtual machines hosting the SaaS data.

Rely on the SaaS provider's built-in eDiscovery tools without additional validation.

Use the SaaS provider's API to export all user data immediately.

A company uses AWS with a centralized logging account. During an incident, the IR team needs to determine whether an attacker used the AWS Management Console or the CLI to create a new IAM user. Which log source should they analyze first?

CloudWatch Logs for the IAM service

AWS Config configuration history

GIAC Enterprise Incident Responder

Domain 2Objective 2

Cloud Response and Analysis GEIR Practice Questions (Page 2)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 6–10

6application · medium
A compromised Azure VM is sending outbound phishing emails. The IR team needs to contain the threat while preserving the ability to analyze the VM's disk. Which containment action should they take?
Select an answer first
7foundation · easy
Which piece of cloud instance metadata is most likely to be targeted by an attacker to escalate privileges?
Select an answer first
8expert · hard
A multinational company uses a SaaS application (e.g., Microsoft 365) and suspects an insider exfiltrated data. The incident responder needs to preserve evidence for potential legal action. The data is stored in a region outside the company's home country. Which consideration is MOST critical when acquiring evidence?
Select an answer first
9application · medium
A company uses AWS with a centralized logging account. During an incident, the IR team needs to determine whether an attacker used the AWS Management Console or the CLI to create a new IAM user. Which log source should they analyze first?
Select an answer first
10foundation · easy
Which Kubernetes artifact records the actions performed by the kubelet and the container runtime, such as pulling images and starting containers?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Cloud Response and Analysis GEIR Practice Questions (Page 2)

Questions 6–10

A compromised Azure VM is sending outbound phishing emails. The IR team needs to contain the threat while preserving the ability to analyze the VM's disk. Which containment action should they take?

Which piece of cloud instance metadata is most likely to be targeted by an attacker to escalate privileges?

A company uses AWS with a centralized logging account. During an incident, the IR team needs to determine whether an attacker used the AWS Management Console or the CLI to create a new IAM user. Which log source should they analyze first?

Which Kubernetes artifact records the actions performed by the kubelet and the container runtime, such as pulling images and starting containers?

Keep studying — Cloud and Container Forensics