An investigator needs to identify all users who accessed a sensitive document in Google Drive during a specific time window. Which Google Workspace log source should be used?

Drive log events in the Admin console

Gmail logs in the Admin console

Google Vault export of the document

Google Takeout of the document owner

A forensic investigator needs to collect a user's Google Workspace data, including email and Drive files, for a legal matter. The user has been terminated and their account has been deleted. The organization has Google Vault with a litigation hold applied to the user's data. What is the most appropriate way to retrieve the data?

Use Google Takeout to export the deleted user's data.

Use the Drive API with domain-wide delegation to access the deleted user's data.

Use the Admin console to restore the user's account and then export via Google Takeout.

Use Google Vault to export the user's data from the hold.

An investigator is analyzing a Google Workspace account that was compromised. The investigator needs to determine if the attacker used a specific IP address to access Gmail and Drive. The organization has enabled Admin console audit logs. Which approach is most effective?

Use Google Takeout to download the mailbox and search locally.

Use the Gmail API to retrieve messages with the IP address in headers.

Use Google Vault to search for emails sent from the IP address.

Search the Admin console's audit logs for the IP address across Gmail and Drive events.

A forensic investigator needs to collect a user's Google Drive files and Gmail messages for a legal hold. The user has already been suspended, and the organization wants to minimize the risk of altering metadata. Which method should the investigator use?

Use the Google Vault export for the user's Drive and Gmail data.

Use the Admin SDK Reports API to retrieve the files directly from Drive.

Use Google Takeout with the user's credentials to download the data.

Use the Admin console to transfer Drive files to another user and then export that user's data.

An organization is investigating a data leak where a user emailed a confidential document to an external party. The investigator needs to determine the exact content of the email and the recipient. The user has since deleted the email from their mailbox. Which method should the investigator use to recover the email content?

Use the Gmail API to retrieve the deleted email from the user's trash.

Use the Admin console's audit log to view the email content.

Use the security investigation tool to recover the deleted email.

Use Google Vault to search for the email, as Vault preserves deleted emails if a hold is applied.

GIAC Cloud Forensics Responder

Domain 3Objective 2

Accessing and Investigating Google Workspace Evidence GCFR Practice Questions (Page 3)

Part of the Google Workspace Forensics domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

2concepts

Questions 11–15

11application · medium
An investigator needs to identify all users who accessed a sensitive document in Google Drive during a specific time window. Which Google Workspace log source should be used?
Select an answer first
12application · medium
A forensic investigator needs to collect a user's Google Workspace data, including email and Drive files, for a legal matter. The user has been terminated and their account has been deleted. The organization has Google Vault with a litigation hold applied to the user's data. What is the most appropriate way to retrieve the data?
Select an answer first
13expert · hard
An investigator is analyzing a Google Workspace account that was compromised. The investigator needs to determine if the attacker used a specific IP address to access Gmail and Drive. The organization has enabled Admin console audit logs. Which approach is most effective?
Select an answer first
14application · medium
A forensic investigator needs to collect a user's Google Drive files and Gmail messages for a legal hold. The user has already been suspended, and the organization wants to minimize the risk of altering metadata. Which method should the investigator use?
Select an answer first
15expert · medium
An organization is investigating a data leak where a user emailed a confidential document to an external party. The investigator needs to determine the exact content of the email and the recipient. The user has since deleted the email from their mailbox. Which method should the investigator use to recover the email content?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Accessing and Investigating Google Workspace Evidence GCFR Practice Questions (Page 3)

Questions 11–15

An investigator needs to identify all users who accessed a sensitive document in Google Drive during a specific time window. Which Google Workspace log source should be used?

An investigator is analyzing a Google Workspace account that was compromised. The investigator needs to determine if the attacker used a specific IP address to access Gmail and Drive. The organization has enabled Admin console audit logs. Which approach is most effective?

A forensic investigator needs to collect a user's Google Drive files and Gmail messages for a legal hold. The user has already been suspended, and the organization wants to minimize the risk of altering metadata. Which method should the investigator use?

Keep studying — Google Workspace Forensics