An Azure VM is suspected of communicating with a malicious IP. The IR team needs to confirm the communication and determine if any data was exfiltrated. They have enabled NSG flow logs, but the logs do not show the payload. What should they do next?

Use Azure Monitor metrics for network throughput

Analyze the NSG flow logs for the malicious IP

Enable Network Watcher packet capture on the VM

An incident responder needs to acquire forensic evidence from a compromised AWS EC2 instance. The instance is still running. Which acquisition method preserves the most volatile data first?

Terminate the instance and then create an AMI

Capture memory using a tool like LiME before taking a disk snapshot

Take a disk snapshot first, then capture memory

Which practice is essential to maintain the chain of custody for cloud forensic evidence?

Using only open-source tools for analysis

Deleting evidence after analysis

Storing evidence in the same region as the incident

Documenting every access to the evidence and its handling

A company uses a hybrid cloud with on-premises servers and AWS. An incident is detected in the cloud environment. The incident response plan was written for on-premises incidents. The responder must adapt the plan. Which adjustment is MOST important?

Focus only on the on-premises components of the incident.

Immediately shut down all cloud resources to prevent spread.

Define how to use cloud-native tools (e.g., snapshots, IAM policy changes) for containment and evidence acquisition.

Contact the cloud provider's support team before taking any action.

GIAC Enterprise Incident Responder

Domain 2Objective 2

Cloud Response and Analysis GEIR Practice Questions (Page 7)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 31–35

31expert · hard
An Azure VM is suspected of communicating with a malicious IP. The IR team needs to confirm the communication and determine if any data was exfiltrated. They have enabled NSG flow logs, but the logs do not show the payload. What should they do next?
Select an answer first
32foundation · easy
Which challenge in cloud forensics is directly related to the fact that multiple customers may share the same physical hardware?
Select an answer first
33application · medium
An incident responder needs to acquire forensic evidence from a compromised AWS EC2 instance. The instance is still running. Which acquisition method preserves the most volatile data first?
Select an answer first
34foundation · easy
Which practice is essential to maintain the chain of custody for cloud forensic evidence?
Select an answer first
35expert · hard
A company uses a hybrid cloud with on-premises servers and AWS. An incident is detected in the cloud environment. The incident response plan was written for on-premises incidents. The responder must adapt the plan. Which adjustment is MOST important?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.