During an investigation, an examiner finds a Google Drive file that was shared with an external user. The examiner needs to determine when the external user first accessed the file. Which metadata source would provide the most reliable answer?

The external user's browser history

The file's 'Created' timestamp in Google Drive

The file's 'Last modified' timestamp

An organization is investigating a data exfiltration incident involving a cloud storage service. The suspect's device is available, but the cloud provider is in a foreign jurisdiction. The legal team needs to preserve evidence while respecting privacy laws. Which acquisition method is MOST appropriate to obtain the cloud-stored data with proper legal standing?

Contact the cloud provider's support team and ask for a backup of the account

Use the suspect's credentials to download the cloud data directly

Serve a legal request (e.g., subpoena or court order) to the cloud provider for the account data

Image the entire hard drive of the suspect's device and extract cloud cache files

When correlating cloud storage artifacts to a specific device, which of the following is a useful device identifier?

The file's last modified timestamp

The device's unique client ID registered with the cloud service

A forensic examiner is investigating a case where sensitive documents were exfiltrated via a cloud storage service. The examiner finds a cloud storage client installed on a shared office computer. Which artifact would MOST reliably link the cloud storage activity to a specific user account?

The last write time of the cloud storage client executable

The file system's $LogFile entries for the cloud storage folder

The cloud storage client's configuration file containing the username and cached credentials

The system's event logs for application crashes

GIAC Certified Forensic Examiner

Domain 6Objective 2

Cloud Storage Analysis GCFE Practice Questions (Page 5)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

Questions 21–25

21application · medium
During an investigation, an examiner finds a Google Drive file that was shared with an external user. The examiner needs to determine when the external user first accessed the file. Which metadata source would provide the most reliable answer?
Select an answer first
22application · medium
An organization is investigating a data exfiltration incident involving a cloud storage service. The suspect's device is available, but the cloud provider is in a foreign jurisdiction. The legal team needs to preserve evidence while respecting privacy laws. Which acquisition method is MOST appropriate to obtain the cloud-stored data with proper legal standing?
Select an answer first
23foundation · easy
When correlating cloud storage artifacts to a specific device, which of the following is a useful device identifier?
Select an answer first
24application · medium
A forensic examiner is investigating a case where sensitive documents were exfiltrated via a cloud storage service. The examiner finds a cloud storage client installed on a shared office computer. Which artifact would MOST reliably link the cloud storage activity to a specific user account?
Select an answer first
25foundation · easy
In cloud storage metadata analysis, which metadata field is most useful for reconstructing the sequence of user actions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Cloud Storage Analysis GCFE Practice Questions (Page 5)

Questions 21–25

During an investigation, an examiner finds a Google Drive file that was shared with an external user. The examiner needs to determine when the external user first accessed the file. Which metadata source would provide the most reliable answer?

When correlating cloud storage artifacts to a specific device, which of the following is a useful device identifier?

A forensic examiner is investigating a case where sensitive documents were exfiltrated via a cloud storage service. The examiner finds a cloud storage client installed on a shared office computer. Which artifact would MOST reliably link the cloud storage activity to a specific user account?

In cloud storage metadata analysis, which metadata field is most useful for reconstructing the sequence of user actions?

Keep studying — User and Cloud Artifacts