A company uses AWS and needs to ensure that CloudTrail logs are available for forensic analysis after an incident. Which configuration is MOST important?

Enable CloudTrail only in the region where the incident occurred.

Enable CloudTrail in all regions and store logs in an S3 bucket with versioning enabled.

Disable CloudTrail logging to reduce costs.

Store CloudTrail logs in the same S3 bucket as the application data.

A multinational company stores data in a public cloud region in the EU. A data breach occurs, and the IR team needs to preserve evidence for a legal case in the US. Which consideration is most important for maintaining chain of custody?

Documenting who accessed the evidence and when

Using a different cloud provider for evidence storage

Ensuring the evidence is stored in the same region as the incident

Deleting all logs after the investigation

An AWS EC2 instance is compromised. The responder needs to determine which IAM role the instance was using and what actions that role could perform. Which source provides this information?

CloudTrail logs for the instance's API calls.

The instance metadata service (IMDSv2) and the IAM policy attached to the role.

The EC2 console's instance details page.

The instance's user data script.

Which artifact is most useful for analyzing the contents and configuration of a container image without running it?

The container's network namespace

GIAC Enterprise Incident Responder

Domain 2Objective 2

Cloud Response and Analysis GEIR Practice Questions (Page 5)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 21–25

21application · medium
A company uses AWS and needs to ensure that CloudTrail logs are available for forensic analysis after an incident. Which configuration is MOST important?
Select an answer first
22application · medium
A multinational company stores data in a public cloud region in the EU. A data breach occurs, and the IR team needs to preserve evidence for a legal case in the US. Which consideration is most important for maintaining chain of custody?
Select an answer first
23application · medium
An AWS EC2 instance is compromised. The responder needs to determine which IAM role the instance was using and what actions that role could perform. Which source provides this information?
Select an answer first
24foundation · easy
Which artifact is most useful for analyzing the contents and configuration of a container image without running it?
Select an answer first
25foundation · easy
Which cloud evidence acquisition technique is most appropriate when you need to collect a logical copy of a specific file or folder from a cloud storage bucket?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.