An investigator needs to collect forensic evidence from a GCP environment that uses multiple regions and zones. The investigator must ensure that the evidence collection process does not alter the original data. Which GCP feature should be used to create a forensic copy of a persistent disk?

Use Cloud Storage to copy the disk contents manually

Use Cloud Functions to replicate the disk in real-time

Use gcloud compute instances stop to halt the instance

Create a snapshot of the persistent disk

An organization needs to ensure that all IAM policy changes are retained for at least one year for compliance. Currently, Admin Activity logs are enabled and stored in Cloud Logging. What is the most reliable way to meet the retention requirement?

Store logs in BigQuery with a 30-day expiration.

Rely on Cloud Logging's default retention of 400 days.

Create a log sink to export Admin Activity logs to a Cloud Storage bucket with a retention policy.

Enable Data Access logs to capture IAM changes.

How are IAM policies applied across the Google Cloud resource hierarchy?

Policies are inherited from parent resources to child resources, so a policy at the project level applies to all resources within that project.

Each resource must have its own IAM policy, and parent policies do not affect child resources.

IAM policies are applied only to the resource where they are defined and are not inherited.

IAM policies are only applied at the organization level and cannot be set at lower levels.

A forensic team is investigating a compromised project. They need to collect evidence from multiple Compute Engine instances, but they must not alter the instances. They also need to ensure that the evidence collection activity is itself auditable. Which approach best meets these requirements?

SSH into each instance and copy files to a forensic workstation.

Use gcloud compute instances export to export the instance configurations.

Grant the team the Compute Instance Admin role and stop the instances.

Create snapshots of the disks and grant the team the Compute Snapshot User role on the project.

GIAC Cloud Forensics Responder

Domain 2Objective 1

Google Cloud Overview and IAM GCFR Practice Questions (Page 1)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

5concepts

Questions 1–5

1application · medium
An investigator needs to collect forensic evidence from a GCP environment that uses multiple regions and zones. The investigator must ensure that the evidence collection process does not alter the original data. Which GCP feature should be used to create a forensic copy of a persistent disk?
Select an answer first
2expert · hard
An organization needs to ensure that all IAM policy changes are retained for at least one year for compliance. Currently, Admin Activity logs are enabled and stored in Cloud Logging. What is the most reliable way to meet the retention requirement?
Select an answer first
3foundation · easy
How are IAM policies applied across the Google Cloud resource hierarchy?
Select an answer first
4application · medium
A forensic analyst needs to export Cloud Audit Logs to a Cloud Storage bucket for long-term retention. The analyst has been granted the Storage Object Creator role on the bucket. What additional IAM permission is required?
Select an answer first
5expert · hard
A forensic team is investigating a compromised project. They need to collect evidence from multiple Compute Engine instances, but they must not alter the instances. They also need to ensure that the evidence collection activity is itself auditable. Which approach best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.