A forensic investigator is collecting evidence from a Google Workspace environment where the user has been using a Chromebook. The investigator needs to collect the user's browsing history, downloads, and Drive files. The user's Chromebook is managed by the organization. Which method should the investigator use to collect the most comprehensive evidence?

Use the Admin console to export the user's Chrome browsing history and Drive files.

Use the Chrome Enterprise API to retrieve the user's browsing history and downloads, and use the Drive API to collect Drive files.

Use Google Vault to export the user's Chrome browsing history and Drive files.

Use Google Takeout to export the user's Chrome browsing history and Drive files.

An investigator is analyzing a data breach where a user's Gmail was accessed via an app password. The investigator needs to determine which apps used the app password and when. The organization has enabled Gmail logs in BigQuery. Which approach is most effective?

Use the Gmail API to list connected apps.

Review the Admin console's Gmail log events.

Use Google Vault to search for emails sent by the user.

Query the BigQuery Gmail logs for the user's app password events.

An investigator is analyzing a security incident and needs to find emails sent by a specific user to an external domain during a specific date range. Which Google Workspace tool or API should be used to query this information efficiently?

Gmail API with the user's OAuth token

Google Vault's search and export functionality

Google Takeout of the user's mailbox

GIAC Cloud Forensics Responder

Domain 3Objective 2

Accessing and Investigating Google Workspace Evidence GCFR Practice Questions (Page 1)

Part of the Google Workspace Forensics domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

2concepts

Questions 1–5

1foundation · easy
An investigator needs to programmatically retrieve a user's Gmail messages and metadata for analysis. Which Google Workspace API is designed for this purpose?
Select an answer first
2expert · hard
A forensic investigator is collecting evidence from a Google Workspace environment where the user has been using a Chromebook. The investigator needs to collect the user's browsing history, downloads, and Drive files. The user's Chromebook is managed by the organization. Which method should the investigator use to collect the most comprehensive evidence?
Select an answer first
3expert · hard
An investigator is analyzing a data breach where a user's Gmail was accessed via an app password. The investigator needs to determine which apps used the app password and when. The organization has enabled Gmail logs in BigQuery. Which approach is most effective?
Select an answer first
4foundation · easy
While investigating a Google Workspace account, an analyst wants to review login events and admin actions to establish a timeline. Which Google Workspace log source is most appropriate for this purpose?
Select an answer first
5application · medium
An investigator is analyzing a security incident and needs to find emails sent by a specific user to an external domain during a specific date range. Which Google Workspace tool or API should be used to query this information efficiently?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Accessing and Investigating Google Workspace Evidence GCFR Practice Questions (Page 1)

Questions 1–5

An investigator needs to programmatically retrieve a user's Gmail messages and metadata for analysis. Which Google Workspace API is designed for this purpose?

An investigator is analyzing a data breach where a user's Gmail was accessed via an app password. The investigator needs to determine which apps used the app password and when. The organization has enabled Gmail logs in BigQuery. Which approach is most effective?

While investigating a Google Workspace account, an analyst wants to review login events and admin actions to establish a timeline. Which Google Workspace log source is most appropriate for this purpose?

An investigator is analyzing a security incident and needs to find emails sent by a specific user to an external domain during a specific date range. Which Google Workspace tool or API should be used to query this information efficiently?

Keep studying — Google Workspace Forensics