~/giac-geir · study ▊
practice sheet · all objectives switch to smart practice →
GIAC Enterprise Incident Response
0/6 checked
During an M365 investigation, a responder needs to detect suspicious user logon and email activity across Exchange and other hosted services. Which log source is described as the common method for this type of detection?
Explanation
The passage identifies the Unified Audit Logs as the common method for detecting suspicious user logon and email activity in M365 [1]. CloudTrail, VPC Flow logs, and GuardDuty are AWS-focused sources [2].
An IR team wants to automate common response tasks in AWS to enable faster, more effective analysis. Which two AWS services are specifically recommended for automation and orchestration?
Explanation
The passages state that common IR tasks can be automated using AWS Lambda and Step Functions [1][2]. GuardDuty and Detective are detection/response services, and CloudTrail is a log source [2].
Locked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to review