What is a key forensic consideration when investigating a compromised virtual machine in the cloud?

The customer can physically seize the server hardware

The cloud provider always retains a full forensic image of every VM

The VM's memory and disk state may be lost if the instance is terminated

The VM's data is automatically backed up to a forensic repository

A company runs a multi-tier web application in a public cloud. The web servers must be reachable from the internet, but the database servers must not be directly accessible from the internet. Which network architecture best meets this requirement?

Use a single load balancer to route traffic to both web and database servers.

Place all servers in a private subnet and use a VPN for all internet traffic.

Place all servers in the same public subnet and rely on security group rules to block database access.

Place web servers in a public subnet and database servers in a private subnet, with a firewall allowing only web servers to reach the database.

Which capability is essential for an organization to perform effective incident response in a cloud environment?

A guarantee that the cloud provider will perform all forensic analysis

Access to centralized logging and monitoring of cloud resources

The ability to modify the hypervisor code

Physical access to the cloud provider's servers

A company is moving a legacy application to the cloud. They have a compliance requirement to retain audit logs for seven years. The application generates logs that are stored in a cloud logging service. Which approach BEST meets the retention requirement while managing costs?

Export logs to an immutable object storage bucket with lifecycle policies for archival

Keep logs in the default logging service with unlimited retention

Delete logs after one year to save costs

Store logs on the application server's local disk

GIAC Information Security Fundamentals

Domain 2Objective 3

Securing Connected and Cloud-Based Environments GISF Practice Questions (Page 2)

Part of the Network and Systems Security domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 6–10

6application · medium
A financial institution wants to keep sensitive customer data on its own hardware but use cloud resources for processing. They want a single management interface. Which deployment model best fits?
Select an answer first
7foundation · easy
What is a key forensic consideration when investigating a compromised virtual machine in the cloud?
Select an answer first
8application · medium
A company runs a multi-tier web application in a public cloud. The web servers must be reachable from the internet, but the database servers must not be directly accessible from the internet. Which network architecture best meets this requirement?
Select an answer first
9foundation · easy
Which capability is essential for an organization to perform effective incident response in a cloud environment?
Select an answer first
10expert · hard
A company is moving a legacy application to the cloud. They have a compliance requirement to retain audit logs for seven years. The application generates logs that are stored in a cloud logging service. Which approach BEST meets the retention requirement while managing costs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.