What is the primary role of the management plane in a cloud environment?

To run antivirus scans on virtual machines

To provide APIs for creating, modifying, and deleting cloud resources

To store user data in object storage

To handle network traffic between virtual machines

A company stores critical evidence in a cloud file storage service. The incident responder needs to preserve the evidence while ensuring the original data is not altered. What is the best approach?

Change the permissions on the share to read-only for all users

Create a read-only snapshot or copy of the storage share and preserve it in a separate location

Move the files to a different folder within the same share

Delete the original files after copying them to a local drive

During an incident in a cloud environment, the incident responder needs to capture a memory image from a virtual machine. Which service model provides the customer with the ability to perform this type of forensic acquisition directly?

Infrastructure as a Service (IaaS)

A company uses a cloud monitoring service to collect logs from its virtual machines and applications. During an incident, the IR team needs to correlate events across multiple VMs and the management plane. Which approach is most effective?

Use the VM's local event logs, which are sufficient for correlation

Centralize logs from VMs, applications, and management-plane audit logs into a single searchable platform

Rely on the cloud provider's default monitoring dashboard, which shows all relevant logs

Collect logs only from the management plane, as they contain all necessary information

A company uses a cloud provider's IAM service. During an incident, the responder needs to determine whether a specific user's credentials were used to perform an action. What is the most reliable evidence?

The user's workstation's local security logs

IAM authentication logs that record the user, timestamp, and source IP for each action

The user's password change history

The cloud provider's billing invoice

GIAC Enterprise Incident Responder

Domain 2Objective 1

Foundational Cloud Concepts GEIR Practice Questions (Page 8)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 36–40

36foundation · easy
What is the primary role of the management plane in a cloud environment?
Select an answer first
37application · medium
A company stores critical evidence in a cloud file storage service. The incident responder needs to preserve the evidence while ensuring the original data is not altered. What is the best approach?
Select an answer first
38foundation · easy
During an incident in a cloud environment, the incident responder needs to capture a memory image from a virtual machine. Which service model provides the customer with the ability to perform this type of forensic acquisition directly?
Select an answer first
39application · medium
A company uses a cloud monitoring service to collect logs from its virtual machines and applications. During an incident, the IR team needs to correlate events across multiple VMs and the management plane. Which approach is most effective?
Select an answer first
40application · medium
A company uses a cloud provider's IAM service. During an incident, the responder needs to determine whether a specific user's credentials were used to perform an action. What is the most reliable evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.