Cloud Storage Analysis GCFE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A user reports that a confidential PDF was uploaded to the corporate Dropbox account from their work laptop, but the user claims they never intentionally shared it. The forensic examiner finds the Dropbox sync log on the laptop. Which combination of log fields would be MOST useful to determine whether the file was actually uploaded from this device and whether it was later shared?

   • ALocal file path, file size, and the sync client version
   • BDevice name, OS version, and the last sync time
   • CFile extension, folder path, and the sync error code
   • DUpload timestamp, file hash, and the user account email
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which piece of cloud storage metadata is most directly tied to a specific user account?

   • AFile size
   • BUser identifier (user ID)
   • CStorage class
   • DFile hash
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A forensic examiner is planning to acquire data from a suspect's OneDrive for Business account. The examiner has a court order but the account is subject to a legal hold. Which acquisition method is most appropriate to preserve evidence while complying with the legal hold?

   • ALog into the account and download all files directly
   • BUse the eDiscovery export feature in Microsoft Purview
   • CRequest a physical copy of the server data from Microsoft
   • DUse the OneDrive sync client to sync the account to a local drive
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A forensic examiner is analyzing a Mac computer that had the OneDrive sync client installed. The user claims they never accessed any files from the cloud. Which local artifact would most likely contain evidence of cloud file access?

   • AThe macOS unified log
   • BThe OneDrive sync engine log files
   • CThe user's browser history
   • DThe OneDrive cache database (e.g., Files.sqlite)
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An examiner is analyzing metadata from a cloud storage service to determine when a file was uploaded and by whom. The cloud metadata shows a 'created' timestamp and a 'modified' timestamp. Which additional metadata field would be MOST useful to attribute the upload to a specific user?

   • AThe file's MIME type
   • BThe file's size in bytes
   • CThe 'owner' or 'uploader' field
   • DThe file's storage class
   Reveal Solution Discussion Select an answer first