GIAC GCTD Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Cloud Threat Detection (GCTD) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GCTD certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GCTD Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Cloud Threat Detection (GCTD) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Cloud Threat Detection exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GCTD Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GCTD Sample Questions:
01. A media company runs 300 EC2 instances that still allow IMDSv1, with session tokens optional. Before requiring IMDSv2, the security team must learn which instances still make IMDSv1 requests and which software on them makes those requests.
Which two sources should the team use?
(Choose two.)
a) CloudTrail data events recorded for Amazon EC2
b) VPC Flow Logs for the subnets, filtered to the 169.254.169.254 address
c) The MetadataNoTokenRejected metric for each instance
d) The MetadataNoToken metric that CloudWatch reports for each of the 300 instances
e) The IMDS Packet Analyzer, run where those calls appear
02. During an RBAC review at a county government, an analyst finds a ClusterRole bound to a third-party monitoring tool's service account. It grants only get on nodes and on the nodes/proxy subresource, and the vendor describes the access as read-only.
Why should the reviewer flag this grant as high risk?
a) Get on nodes exposes the Secret values that pods have mounted on each node
b) The subresource lets the account change each node's instance profile in the cloud provider, outside Kubernetes RBAC and its audit trail
c) A cluster-wide binding is never acceptable for a third-party monitoring tool, whatever verbs or resources the role grants
d) The subresource reaches the kubelet API, which can run commands in the node's pods outside API-server auditing
03. Three weeks ago an insurer's cloud team assigned the built-in Azure Policy initiative that enables allLogs resource logging to its Log Analytics workspace, at the production management group, leaving every other assignment option at its default. The compliance summary for key vaults now reads:
- Created after assignment: 9 vaults, compliant, logs arriving
- Created before assignment: 41 vaults, non-compliant, no diagnostic setting
What explains the 41 vaults, and what fixes it?
a) Change the initiative's effect to Deny so that the non-compliant vaults are blocked until each is reconfigured
b) Reassign the initiative at each subscription instead of the management group, so its scope reaches the existing vaults
c) The assignment reaches only new resources; create a remediation task so the existing vaults get settings
d) Wait for the next compliance evaluation cycle, which deploys the settings to the older vaults
04. A game studio's EC2 instance has primary private address 10.0.2.10 and a secondary address 10.0.2.44 that a second application listens on. The interface's existing default-format flow log never shows 10.0.2.44 as a destination, so analysts cannot tell which application some suspicious inbound flows targeted.
How can the team get the flow logs themselves to record the original destination address?
a) Edit the existing flow log and add the pkt-dstaddr field to the end of its current record format
b) Create a new flow log on the interface with a custom format that includes pkt-dstaddr
c) Delete the flow log and recreate it in the default format with a one-minute maximum aggregation interval
d) Filter the existing records on dstaddr equal to 10.0.2.44
05. Before tightening monitoring, a university's Azure team must find which of its 200 storage accounts and Azure SQL databases hold passport and national ID numbers.
Which two capabilities identify where that data is stored?
(Choose two.)
a) Azure Policy compliance assessment of each account
b) Blob resource logs sent to a Log Analytics workspace by a diagnostic setting
c) Microsoft Purview Data Map classification scans
d) Azure Resource Graph queries across every subscription and resource group
e) Sensitive data discovery in Microsoft Defender for Cloud
06. Hundreds of blobs vanished from a county government's records container last week. The account's blob diagnostic setting, which sends to a Log Analytics workspace, contains:
"logs": [{"category": "StorageRead", "enabled": true}, {"category": "StorageWrite", "enabled": true}, {"category": "StorageDelete", "enabled": false}]
A query for DeleteBlob operations in StorageBlobLogs returns nothing, while that week's reads and writes are present. Why are the deletions missing?
a) Logs are discarded for blobs that no longer exist
b) The deletions from last week have not been ingested yet
c) Blob deletions are control-plane operations kept in the Activity log
d) The StorageDelete category was not enabled in the blob diagnostic setting
07. At a retail chain, a regional manager reports after a suspicious sign-in that replies from a key supplier never reach her inbox. The analyst suspects a mailbox rule that moves or forwards those messages and needs to know who created it and when.
Which log records this activity?
a) The Azure Activity log for the subscription
b) The Microsoft Entra audit log for the tenant
c) The Microsoft Purview audit log
d) The Microsoft Entra sign-in log entries
08. For a county government's incident report, legal asks an analyst to state exactly how many requests an Application Load Balancer received during the incident window, and how many reached the application, using only the load balancer's access logs.
Which two properties of these logs must the analyst state alongside the figures?
(Choose two.)
a) The log also holds the API calls made to change the load balancer's settings
b) The client:port field holds the end user's address even when a proxy fronts the load balancer
c) Entries are written on a best-effort basis, so the totals describe the traffic but are not a guaranteed complete count
d) Requests that the load balancer answered itself without forwarding them to a target are logged as well
e) Each entry records the request body, so form submissions made in the window can be counted by their content
09. A university research container allowed anonymous blob reads for a week. A diagnostic setting sending the account's blob logs to a Log Analytics workspace was in place throughout, and StorageBlobLogs shows dozens of successful anonymous reads. An external scan report says the same scanner also requested hundreds of blob names that do not exist and received 404 responses, yet none of those requests appear.
Why are the 404 requests missing from the logs?
a) The diagnostic setting left out the StorageRead category for the account
b) The storage firewall dropped the probes and logged them to flow logs instead
c) Azure Storage does not record failed anonymous requests like these 404 responses in its logs
d) Failed blob reads go to the Activity log instead of resource logs
10. To cut cost, a media company's only trail drops AWS KMS calls from its management events with the advanced event selector {"Field": "eventSource", "NotEquals": ["kms.amazonaws.com"]}. No event data store exists. Someone may have called Decrypt with a customer managed key in us-east-2 two days ago.
Where can the analyst find who made that call?
a) The trail's log files in Amazon S3, searched for the Decrypt event name
b) CloudTrail Event history for us-east-2 in that account
c) CloudTrail Insights events enabled on the trail for unusual KMS call rates
d) AWS Config configuration history recorded for the customer managed key
Answers:
|
Question: 01 Answer: d, e |
Question: 02 Answer: d |
Question: 03 Answer: c |
Question: 04 Answer: b |
Question: 05 Answer: c, e |
|
Question: 06 Answer: d |
Question: 07 Answer: c |
Question: 08 Answer: c, d |
Question: 09 Answer: c |
Question: 10 Answer: b |
Note: For any error in GIAC Cloud Threat Detection (GCTD) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
