When acquiring data from a cloud storage service for forensic purposes, which of the following is a key legal consideration?

Obtaining proper legal authorization, such as a warrant or consent

Ensuring the cloud provider uses encryption at rest

Confirming the cloud provider's data center is in the same country

Using a forensic imaging tool to create a bit-for-bit copy

During a forensic examination of a Windows system, the examiner finds residual artifacts from a cloud storage client that has been uninstalled. Which location would MOST likely contain remnants of the client's cached data and configuration?

The Windows Registry's HKLM hive

The user's AppData\Local folder

An examiner is reconstructing a timeline of a user's activity with a cloud storage service. The examiner has the following artifacts: sync logs, local cache files, and cloud metadata. Which approach would produce the MOST accurate timeline of user actions?

Rely solely on the cloud provider's audit logs without local artifacts

Use the file system's MFT timestamps for all files in the cloud storage folder

Sort the sync logs by timestamp and correlate with cloud metadata timestamps

Use only the local cache file timestamps to build the timeline

A forensic examiner is investigating a case involving a cloud storage service. Which of the following is an example of a cloud storage artifact that would be found on the user's local device?

The cloud provider's data center access logs

A cached copy of a file that was previously opened from the cloud

The cloud provider's billing records

The cloud provider's authentication server logs

GIAC Certified Forensic Examiner

Domain 6Objective 2

Cloud Storage Analysis GCFE Practice Questions (Page 2)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

Questions 6–10

6foundation · easy
When acquiring data from a cloud storage service for forensic purposes, which of the following is a key legal consideration?
Select an answer first
7application · medium
During a forensic examination of a Windows system, the examiner finds residual artifacts from a cloud storage client that has been uninstalled. Which location would MOST likely contain remnants of the client's cached data and configuration?
Select an answer first
8application · medium
An examiner is investigating a case where a user accessed a cloud storage service through a web browser. Which local artifact would MOST likely contain cached copies of files viewed or downloaded from the cloud service?
Select an answer first
9application · medium
An examiner is reconstructing a timeline of a user's activity with a cloud storage service. The examiner has the following artifacts: sync logs, local cache files, and cloud metadata. Which approach would produce the MOST accurate timeline of user actions?
Select an answer first
10foundation · easy
A forensic examiner is investigating a case involving a cloud storage service. Which of the following is an example of a cloud storage artifact that would be found on the user's local device?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.