Foundational Cloud Concepts GEIR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company uses a PaaS service to host a web application. During an incident, the IR team needs to collect logs from the application and the platform. According to the shared responsibility model, which logs is the customer most likely able to access directly?

   • APhysical server hardware logs from the data center
   • BHypervisor-level logs from the underlying virtual machines
   • CApplication logs generated by the customer's code and platform-provided application-level logs
   • DNetwork packet captures from the provider's core routers
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During an incident, a responder needs to determine which user deleted a critical cloud resource. What is the most reliable evidence source?

   • AThe user's local browser history
   • BCloud provider's identity and access management audit logs that record the user and API call
   • CThe deleted resource's configuration file
   • DNetwork flow logs from the user's workstation
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An incident responder needs to identify all API calls made by a compromised service account in a cloud environment. Which log source should be examined?

   • ACloud provider's activity logs that record all API requests and the associated identity
   • BVirtual machine system logs
   • CNetwork flow logs
   • DApplication logs from the web server
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company uses a serverless computing platform (FaaS) for a critical application. During an incident, the responder needs to collect evidence of unauthorized function invocations. What is the most appropriate evidence source?

   • AThe function's source code repository logs
   • BA memory dump of the server that runs the function
   • CA network packet capture from the function's virtual network
   • DThe cloud provider's function execution logs and invocation history
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An organization is moving a legacy application to the cloud. The application requires custom network configurations and the IR team needs full access to the operating system for forensic purposes. The organization also wants to minimize the management overhead of the underlying infrastructure. Which cloud service model best balances these requirements?

   • ACommunity cloud, because it provides dedicated infrastructure and full OS access
   • BIaaS, because it provides full control over the OS and network while the provider manages the physical infrastructure
   • CPaaS, because it provides full OS access and the provider manages the network
   • DSaaS, because it provides the lowest management overhead and full forensic access
   Reveal Solution Discussion Select an answer first