A regional hospital uses a community cloud shared with three other hospitals to run a patient-triage application. During an incident, the IR team needs to preserve logs that show which hospital's staff accessed a specific patient record. The cloud provider manages the hypervisor and the application platform, while each hospital manages its own user accounts and data. Which evidence source is most likely to provide the needed attribution?

The provider's physical server access logs, which record who entered the data center

The application's audit logs, which record the authenticated user ID and the hospital tenant for each access

The network firewall logs from the community cloud's shared perimeter, which show source IP addresses of all traffic

The hypervisor's virtual machine event logs, which show when each hospital's VM was started and stopped

Which of the following is an example of evidence that can be collected from the cloud management plane during an incident?

Network packet captures from the VM's virtual NIC

Memory dump of a compromised VM

File system contents of a storage bucket

API call logs showing who created a new VM

An organization stores forensic evidence in an object storage bucket in the cloud. The IR team needs to ensure that the evidence is not modified or deleted during the investigation. Which configuration is most appropriate?

Enable object versioning and configure a retention policy that prevents deletion for a specified period

Take a snapshot of the bucket using the provider's snapshot feature

Copy the objects to a local on-premises server and rely on the local copy

Set the bucket to private and rely on access controls to prevent changes

A company uses a PaaS database service. During an incident, the responder needs to preserve evidence of malicious queries. Which evidence source is most likely available to the customer?

A memory dump of the database server's host OS

Database audit logs enabled through the PaaS service's built-in auditing feature

Network packet captures from the database server's physical NIC

The database server's system event log from the guest OS

An incident responder needs to preserve evidence from an object storage bucket that may contain deleted files. The cloud provider offers versioning on the bucket. What should the responder do to maximize the chance of recovering deleted objects?

Rely on the provider's backup service to restore the bucket from last night's backup

Immediately delete the bucket to prevent further modification

Copy only the current version of each object to a new bucket

Enable versioning on the bucket if not already enabled, then list and preserve all versions of the objects

GIAC Enterprise Incident Responder

Domain 2Objective 1

Foundational Cloud Concepts GEIR Practice Questions (Page 9)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 41–45

41application · medium
A regional hospital uses a community cloud shared with three other hospitals to run a patient-triage application. During an incident, the IR team needs to preserve logs that show which hospital's staff accessed a specific patient record. The cloud provider manages the hypervisor and the application platform, while each hospital manages its own user accounts and data. Which evidence source is most likely to provide the needed attribution?
Select an answer first
42foundation · easy
Which of the following is an example of evidence that can be collected from the cloud management plane during an incident?
Select an answer first
43application · medium
An organization stores forensic evidence in an object storage bucket in the cloud. The IR team needs to ensure that the evidence is not modified or deleted during the investigation. Which configuration is most appropriate?
Select an answer first
44application · medium
A company uses a PaaS database service. During an incident, the responder needs to preserve evidence of malicious queries. Which evidence source is most likely available to the customer?
Select an answer first
45application · medium
An incident responder needs to preserve evidence from an object storage bucket that may contain deleted files. The cloud provider offers versioning on the bucket. What should the responder do to maximize the chance of recovering deleted objects?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.