GCFR 시험 - GIAC실제시험문제와 답 - 82문항

Question No : 1

Which EBS volume type would be appropriate to support a business critical SQL server hosted In AWS?

A.ST1
B.GP3
C.GP2
D.I01

정답:

Question No : 2

Which of the following is available with the free tier of service for CloudTrail?

A.Single trail of management events delivered to Amazon
B.Access to data-related API Cloud Trail events
C.Access to CloudTrail Insights to detect anomalies
D.Default trail maintained by AWS for more than 90 days

정답:

Question No : 3

What 1$ a drawback of analyzing a snapshot outside of AWS?

A.Incomplete data
B.Long download time
C.Incompatible image format
D.Low latency

정답:

Question No : 4

What can be inferred about the ARN below?
arn:aws:!am::457787814323:user/giac

A.giac's is a user In the AWS account 457787814323
B.giac's access Is testf kted to resources owned by AWS tenant 457787814323
C.giac's Is limited to roles defined under a single AWS organization
D.giac's user's access key 10 is 457787814323

정답:

Question No : 5

Which is a limitation when adding GPUs to Google cloud VMs?

A.They can only be added at VM creation
B.Preemptible VMs do not support GPU addition
C.Google limits the GPUs assigned to a single VM
D.They are only available in specific zones

정답:

Question No : 6

A company using PaaS to host and develop their software application is experiencing a DOS attack.
What challenge will a DFIR analyst experience when investigating this attack?

A.Restricted access to their application logs
B.Resource scaling will affect access to logs
C.Network logs are unavailable for review
D.Network monitoring disabled by the company

정답:

Question No : 7

Which statement describes how an organization could use IPv6 in a Google Cloud deployment?

A.IPv6 has to be configured for each compute node Individually
B.IPv6 b enabled by default for global traffic between VPCs
C.IPv6 is enabled by default for traffic within VPCs
D.IPv6 needs to be terminated at an edge load balancer

정답:

Question No : 8

An analyst successfully authenticated to Microsoft 365 using the following command.
What would cause the analyst to be unable to search UAL events for a specific time period?
Ps> connect fxrhangeOnline userPrincipalName sysanalystatexanpteco.com

A.The tmdlets to search the UAl were not Imported into the session
B.The UAL cannot be searched when using Microsoft 365 PowerShell
C.The incorrect version of the FxhangeOnlineManagement module was installed
D.The ExchangeOnlineManagement module was not installed

정답:

Question No : 9

The attack technique "Access Kubelet API" falls under which Mitre ATT&CK tactic?

A.Execution
B.Credential Access
C.Discovery
D.Initial Access

정답:

Question No : 10

An investigator his successfully installed the ExchangeOnlineManagement module on their investigation system and is attempting to search a client's Microsoft 365 Unified Audit Log using PowerShell. PowerShell returns a "command not found" error each time they try to execute the Search-UnifiedAuditLog cmdlet.
How should the investigator troubleshoot this issue?

A.Ensure their system has .NFT version 4.b or later Installed
B.Ensure that MFA has been disabled for The account used
C.Check that they are using PowerShell Core
D.Check the permissions of the account used in Microsoft 365

정답:

Question No : 11

At what organizational level are EC2 services managed by customers?

A.Data center
B.Regional
C.Global
D.Continental

정답:

Question No : 12

An investigator is evaluating a client's Microsoft 365 deployment using the web portals and has identified that the Purview compliance portal states that the Unified Audit Logs are not enabled.
Based on the additional Information gathered below, what is most likely the cause of this configuration message?
Subscription creation date: December 4, 2021 Number of administrators: 2 Number of non-administrative user accounts: 74 Last tenant administration change: December 4,2021

A.Explicitly been disabled by an administrator
B.License was downgraded lower than an E5 license
C.Tenant is configured to forward logs externally
D.Default configuration, service was never enabled

정답:

Question No : 13

Sensitive company data is found leaked on the internet, and the security team didn't get any alert and is unsure of how the breach occurred.
Which logs would be a preferable starting point for an investigation?

A.Identity and Access Management
B.Application
C.Resource Management
D.Endpoint

정답:

Question No : 14

Which AW5 1AM policy element indicates the API that is in scope?

A.Effect
B.Version
C.Action
D.Resource

정답:

Question No : 15

What method does Google use to alert Gmail account holders that they may be under attack by government sponsored attackers?

A.Message upon successful logon
B.SMS text message
C.Email sent to the user
D.Alert sent to recovery account

정답:

GIAC GCFR 시험