A company uses a hybrid cloud environment. An incident responder needs to correlate an attack that started on-premises and moved to the cloud. Which logging strategy is most effective?

Only collect cloud logs because the attack moved to the cloud

Use the cloud provider's logs exclusively because they are more reliable

Keep on-premises and cloud logs separate to avoid mixing data

Centralize logs from both on-premises and cloud sources into a single SIEM with normalized timestamps

A company uses a SaaS email platform and suspects a user's mailbox was compromised. The incident responder needs to obtain forensic evidence of the attacker's actions. Which action is most appropriate given the shared responsibility model?

Use the provider's API to reset the mailbox password and then log in as the user to review sent items

Request the provider's audit logs and mailbox forensic export via the provider's eDiscovery or support process

Deploy a network sniffer on the provider's email servers to capture the attacker's traffic

Take a memory image of the email server from the hypervisor console

A company uses an IaaS cloud provider. An incident responder needs to collect evidence from a compromised virtual machine. Which evidence source is the customer responsible for collecting?

Provider's data center access logs

Guest OS logs and application logs from inside the VM

Hypervisor-level memory dumps of the VM

An organization's incident response team needs to acquire forensic images of virtual machines in a private cloud environment. What is the most important consideration when planning the acquisition?

The team cannot acquire virtual disks because virtualization prevents forensic imaging

The team can access the hypervisor and storage backend directly, allowing snapshot-based acquisition without involving a third party

The team must use only the cloud provider's API to create snapshots because direct hypervisor access is never available

The team must request a legal warrant from the cloud provider before acquiring any data

GIAC Enterprise Incident Responder

Domain 2Objective 1

Foundational Cloud Concepts GEIR Practice Questions (Page 3)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 11–15

11foundation · easy
In the data lifecycle, which stage involves creating a forensic copy of evidence to prevent alteration of the original data?
Select an answer first
12expert · hard
A company uses a hybrid cloud environment. An incident responder needs to correlate an attack that started on-premises and moved to the cloud. Which logging strategy is most effective?
Select an answer first
13application · medium
A company uses a SaaS email platform and suspects a user's mailbox was compromised. The incident responder needs to obtain forensic evidence of the attacker's actions. Which action is most appropriate given the shared responsibility model?
Select an answer first
14application · medium
A company uses an IaaS cloud provider. An incident responder needs to collect evidence from a compromised virtual machine. Which evidence source is the customer responsible for collecting?
Select an answer first
15application · medium
An organization's incident response team needs to acquire forensic images of virtual machines in a private cloud environment. What is the most important consideration when planning the acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.