An employee reports that a confidential file was accidentally shared via the company's OneDrive for Business. The forensic examiner needs to determine whether the file was ever downloaded by an external user. Which combination of artifacts should the examiner prioritize?

OneDrive sync client logs on the employee's workstation and the SharePoint Online audit log

The local OneDrive cache files and the employee's email archive

The SharePoint Online audit log and the OneDrive for Business sharing metadata

The employee's browser history and the OneDrive recycle bin

An examiner is analyzing a Mac that had the Dropbox client installed. The user claims they only used the web interface. Which local artifact would most likely disprove this claim?

The Dropbox cache database (e.g., config.dbx)

An examiner is investigating a data breach involving a company's OneDrive for Business. The examiner needs to determine which user account uploaded a sensitive file. Which metadata source would provide the most reliable attribution?

The file's local NTFS owner SID

The file's 'Created by' field in SharePoint Online

The file's last modified timestamp

Which of the following is an example of a local residual artifact left by a cloud storage application?

The cloud provider's billing statement

The cloud provider's server configuration file

A temporary file containing partial upload data

The user's browser history on the cloud provider's website

Which of the following is a technical method for acquiring data from a cloud storage service during an investigation?

Using the cloud provider's API to download the user's files

Requesting a backup tape from the cloud provider

Intercepting network traffic to the cloud service

Seizing the cloud provider's physical servers

GIAC Certified Forensic Examiner

Domain 6Objective 2

Cloud Storage Analysis GCFE Practice Questions (Page 6)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

Questions 26–30

26application · medium
An employee reports that a confidential file was accidentally shared via the company's OneDrive for Business. The forensic examiner needs to determine whether the file was ever downloaded by an external user. Which combination of artifacts should the examiner prioritize?
Select an answer first
27expert · hard
An examiner is analyzing a Mac that had the Dropbox client installed. The user claims they only used the web interface. Which local artifact would most likely disprove this claim?
Select an answer first
28application · medium
An examiner is investigating a data breach involving a company's OneDrive for Business. The examiner needs to determine which user account uploaded a sensitive file. Which metadata source would provide the most reliable attribution?
Select an answer first
29foundation · easy
Which of the following is an example of a local residual artifact left by a cloud storage application?
Select an answer first
30foundation · easy
Which of the following is a technical method for acquiring data from a cloud storage service during an investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.