An organization uses a cloud IAM system with federated identity. During an incident, the IR team needs to determine which on-premises user accessed a cloud resource. The cloud audit logs show a federated principal name but not the on-premises user. Which action is most appropriate?

Use the cloud provider's IAM logs, which contain the on-premises username

Use the network logs from the on-premises firewall to identify the user

Request the cloud provider to provide the on-premises user information

Correlate the cloud audit logs with the on-premises identity provider's authentication logs to map the federated principal to the on-premises user

An organization operates a private cloud for sensitive data and also uses a public cloud for less sensitive workloads. During an incident, the responder needs to preserve evidence from both environments. What is the most important consideration?

The same forensic tools can be used identically in both environments

The acquisition methods and legal authority may differ between the private and public environments

The private cloud does not require any forensic process because it is internal

Evidence from the public cloud is always more reliable

A company uses a cloud storage service with lifecycle policies that automatically delete objects after 30 days. An incident responder needs to preserve evidence that is 45 days old. What is the most effective action?

Disable the lifecycle policy immediately and hope the objects are still there

Restore the objects from a backup or versioning before the lifecycle policy deletes them

Contact the cloud provider to recover the objects from tape

Accept the loss because lifecycle policies are irreversible

In the shared responsibility model, which of the following is typically the responsibility of the cloud customer in an IaaS deployment?

Network infrastructure maintenance

Patching the guest operating system

Physical security of the data center

GIAC Enterprise Incident Responder

Domain 2Objective 1

Foundational Cloud Concepts GEIR Practice Questions (Page 4)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 16–20

16expert · hard
An organization uses a cloud IAM system with federated identity. During an incident, the IR team needs to determine which on-premises user accessed a cloud resource. The cloud audit logs show a federated principal name but not the on-premises user. Which action is most appropriate?
Select an answer first
17foundation · easy
Which cloud deployment model is most likely to require the incident responder to coordinate with both on-premises and cloud provider teams during evidence collection?
Select an answer first
18expert · hard
An organization operates a private cloud for sensitive data and also uses a public cloud for less sensitive workloads. During an incident, the responder needs to preserve evidence from both environments. What is the most important consideration?
Select an answer first
19expert · hard
A company uses a cloud storage service with lifecycle policies that automatically delete objects after 30 days. An incident responder needs to preserve evidence that is 45 days old. What is the most effective action?
Select an answer first
20foundation · easy
In the shared responsibility model, which of the following is typically the responsibility of the cloud customer in an IaaS deployment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.