GIAC Cloud Forensics Responder
Domain 3Objective 2
Accessing and Investigating Google Workspace Evidence GCFR Practice Questions (Page 2)
Part of the Google Workspace Forensics domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)
17questions here
4free pages
2concepts
Questions 6–10
- 6
During an investigation, you need to determine if a user shared a specific file with an external party. The file is in Google Drive, and the user is a member of your organization. Which audit log should you review?
Select an answer first - 7
A forensic investigator needs to obtain a comprehensive export of a user's Google Workspace data, including Gmail messages, Drive files, and Calendar entries, for offline analysis. Which method is specifically designed for this purpose?
Select an answer first - 8
A legal team needs to preserve a user's Google Workspace data for an upcoming litigation. The user is still employed and should continue working normally. Which action should the investigator take?
Select an answer first - 9
An investigator is investigating a phishing attack that originated from a compromised Google Workspace account. The investigator needs to trace the attacker's actions, including emails sent, Drive files accessed, and login locations. The organization has enabled Admin console audit logs but has not set up BigQuery export. Which approach is most efficient?
Select an answer first - 10
An investigator is investigating a case where a user's Google Workspace account was used to send phishing emails. The investigator needs to determine the source IP address of the phishing emails and whether the user's account was compromised. The organization has enabled Gmail logs in BigQuery. Which approach is most effective?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.