A security analyst is investigating a phishing incident where a user clicked a malicious link in Gmail. The analyst needs to determine the exact time the user clicked the link and the IP address used. Which log source should the analyst query?

Gmail SMTP logs from the Admin console

Google Workspace security investigation tool's Gmail log events

Gmail message audit logs from the Admin console

Google Workspace login audit logs

GIAC Cloud Forensics Responder

Domain 3Objective 2

Accessing and Investigating Google Workspace Evidence GCFR Practice Questions (Page 4)

Part of the Google Workspace Forensics domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

2concepts

Questions 16–17

16foundation · easy
An investigator is analyzing a Google Drive file that may have been shared externally. Which metadata field in the Drive file's properties would be most useful to confirm external sharing?
Select an answer first
17application · medium
A security analyst is investigating a phishing incident where a user clicked a malicious link in Gmail. The analyst needs to determine the exact time the user clicked the link and the IP address used. Which log source should the analyst query?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Accessing and Investigating Google Workspace Evidence GCFR Practice Questions (Page 4)

Questions 16–17

An investigator is analyzing a Google Drive file that may have been shared externally. Which metadata field in the Drive file's properties would be most useful to confirm external sharing?

A security analyst is investigating a phishing incident where a user clicked a malicious link in Gmail. The analyst needs to determine the exact time the user clicked the link and the IP address used. Which log source should the analyst query?

Keep studying — Google Workspace Forensics