Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 12)

Questions 56–57

1. 56expert · hard

   An organization runs a hybrid environment with on-premises servers and AWS. During an incident, the analyst finds that the on-premises SIEM has no logs from an AWS EC2 instance that was compromised. The instance was launched three months ago. Which action is most likely to recover the missing visibility?

   • AEnable VPC Flow Logs for the instance's subnet and query historical flow logs
   • BCheck if the EC2 instance had the CloudWatch agent installed and if the IAM role allowed log delivery to CloudWatch Logs
   • CRequest a snapshot of the instance from AWS Support to recover deleted logs
   • DUse AWS CloudTrail to retrieve the instance's system logs
   Reveal Solution Discussion Select an answer first
2. 57expert · hard

   A company has a flat network with no segmentation. They have EDR on all endpoints and NetFlow on the core switch. During an incident, they detect malware on one workstation. The EDR shows the malware attempted to connect to several internal IPs. Which visibility limitation is most likely to hinder scoping?

   • AThe flat network prevents any network monitoring
   • BNetFlow may show the connections but not the application or process that initiated them
   • CNetFlow cannot capture traffic between internal hosts
   • DEDR does not record network connections at all
   Reveal Solution Discussion Select an answer first