A forensic investigator needs to collect evidence from a GCP project that spans multiple regions. The investigator must ensure that audit logs are retained for 90 days and are accessible even if the project is deleted. Which approach should be used?

Enable VPC Flow Logs and store them in BigQuery

Create a log sink to export audit logs to a Cloud Storage bucket in a different project with a 90-day lifecycle rule

Enable Cloud Audit Logs and set the retention period to 90 days in the project settings

Use Cloud Functions to copy audit logs to a local server daily

An organization is setting up a forensic investigation team. To ensure separation of duties, which IAM configuration should be used?

Create two groups: one with Security Reviewer role for analysis and another with Storage Admin role for evidence handling.

Grant all team members the Owner role to simplify access.

Use a single custom role that includes both security review and storage management permissions.

Grant the same team both the Security Reviewer and Storage Admin roles.

Which of the following correctly lists the three components of an IAM policy binding?

Project, folder, and organization

User, group, and service account

Resource, permission, and action

An organization is designing a forensic investigation workflow. The workflow requires that the investigator can create snapshots of disks, but cannot delete snapshots or modify instances. Additionally, the investigator must be able to read audit logs. Which IAM configuration satisfies these requirements with least privilege?

Grant the Compute Instance Admin and Private Logs Viewer roles.

Create a custom role with compute.snapshots.create and logging.logEntries.list permissions.

Grant the Compute Snapshot User and Logs Viewer roles.

Grant the Compute Storage Admin and Logs Viewer roles.

A forensic team is preparing for an investigation that may require accessing resources across multiple projects. To follow least privilege, what is the best way to grant the team access?

Grant each team member the Owner role on all projects

Use service account keys and share them with the team

Create a custom role with only the permissions needed for the investigation and grant it to the team at the folder level

Grant the team the Viewer role on each project individually

GIAC Cloud Forensics Responder

Domain 2Objective 1

Google Cloud Overview and IAM GCFR Practice Questions (Page 2)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

5concepts

Questions 6–10

6application · medium
A forensic investigator needs to collect evidence from a GCP project that spans multiple regions. The investigator must ensure that audit logs are retained for 90 days and are accessible even if the project is deleted. Which approach should be used?
Select an answer first
7application · medium
An organization is setting up a forensic investigation team. To ensure separation of duties, which IAM configuration should be used?
Select an answer first
8foundation · easy
Which of the following correctly lists the three components of an IAM policy binding?
Select an answer first
9expert · hard
An organization is designing a forensic investigation workflow. The workflow requires that the investigator can create snapshots of disks, but cannot delete snapshots or modify instances. Additionally, the investigator must be able to read audit logs. Which IAM configuration satisfies these requirements with least privilege?
Select an answer first
10application · medium
A forensic team is preparing for an investigation that may require accessing resources across multiple projects. To follow least privilege, what is the best way to grant the team access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.