During an investigation of an S3 bucket, the responder needs to identify who accessed a specific object and when. The bucket has server access logging enabled, and logs are stored in a separate logging bucket. Which data source provides the most direct evidence of object-level access?

The bucket's versioning history

The server access logs in the logging bucket

A forensic investigator needs to determine the exact time an EC2 instance was launched and the AMI it was based on. Which source provides this information?

The instance's metadata service

The security group configuration

A company uses Amazon EFS for shared storage across multiple EC2 instances. During an investigation, the responder needs to acquire a forensic copy of a specific file that was recently modified. Which acquisition method is most appropriate?

Use the EFS console to export the file

Access the file through the S3 API

Copy the file directly from the EFS file system using a mounted instance

Create an EBS snapshot of the EFS file system

A forensic analyst needs to acquire memory from a running EC2 instance for analysis. The instance is running a critical production workload and cannot be stopped. Which approach is most appropriate for acquiring memory while minimizing impact?

Use a third-party memory acquisition tool installed on the instance

Use the EC2 instance's console to capture a memory dump

Create a snapshot of the instance's EBS volumes

Use the AWS Systems Manager to capture memory

A responder is reviewing the network configuration of a compromised instance. The instance's security group allows inbound RDP from a specific IP range, and the network ACL allows all traffic. The responder wants to determine if the attacker could have bypassed the security group restriction. Which factor is most relevant?

The instance's OS firewall may allow RDP from other IPs

The network ACL is stateless and evaluated before security groups

The route table may route traffic around the security group

The security group is stateful and allows return traffic automatically

GIAC Cloud Forensics Responder

Domain 4Objective 2

AWS Networking, VMs, and Storage GCFR Practice Questions (Page 6)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

7concepts

Questions 26–30

26application · medium
During an investigation of an S3 bucket, the responder needs to identify who accessed a specific object and when. The bucket has server access logging enabled, and logs are stored in a separate logging bucket. Which data source provides the most direct evidence of object-level access?
Select an answer first
27application · medium
A forensic investigator needs to determine the exact time an EC2 instance was launched and the AMI it was based on. Which source provides this information?
Select an answer first
28application · medium
A company uses Amazon EFS for shared storage across multiple EC2 instances. During an investigation, the responder needs to acquire a forensic copy of a specific file that was recently modified. Which acquisition method is most appropriate?
Select an answer first
29expert · hard
A forensic analyst needs to acquire memory from a running EC2 instance for analysis. The instance is running a critical production workload and cannot be stopped. Which approach is most appropriate for acquiring memory while minimizing impact?
Select an answer first
30application · medium
A responder is reviewing the network configuration of a compromised instance. The instance's security group allows inbound RDP from a specific IP range, and the network ACL allows all traffic. The responder wants to determine if the attacker could have bypassed the security group restriction. Which factor is most relevant?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.