GIAC Certified Forensic Examiner
Domain 6Objective 2
Cloud Storage Analysis GCFE Practice Questions (Page 7)
Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)
37questions here
8free pages
7concepts
Questions 31–35
- 31
An examiner is reconstructing a timeline of a user's Dropbox activity on a Windows 10 machine. Which set of artifacts would provide the most reliable chronological sequence of file uploads, downloads, and deletions?
Select an answer first - 32
What is the primary purpose of timeline reconstruction in cloud storage analysis?
Select an answer first - 33
Which type of artifact would be most helpful for building a timeline of cloud storage activity?
Select an answer first - 34
Where would a forensic examiner most likely find the local cache of a cloud storage application on a Windows system?
Select an answer first - 35
When interpreting a cloud storage synchronization log, which entry would indicate that a file was removed from the cloud storage service?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.