A forensic investigator is analyzing a security incident and needs to determine the exact time a specific IAM policy was changed. The investigator has access to the project's Admin Activity audit logs. Which field in the log entry should the investigator examine?

The 'authenticationInfo.principalEmail' field

An organization uses primitive roles (Owner, Editor, Viewer) for its GCP project. A forensic investigation reveals that a former employee with the Editor role deleted a Cloud Storage bucket. What is the most effective way to prevent this from happening in the future while maintaining necessary access for other users?

Create a custom role with only the permissions needed for each user's job and assign it to them

Grant all users the roles/storage.objectAdmin role instead

Remove the Editor role from all users and grant them the Viewer role

Enable Cloud Audit Logs to track all deletions

A project has an IAM policy that grants a user the Storage Admin role at the project level. The user is also a member of a group that has the Storage Viewer role at the folder level. What effective permissions does the user have on a bucket in that folder?

Storage Admin permissions only on the folder, not the project

Full storage administration permissions

GIAC Cloud Forensics Responder

Domain 2Objective 1

Google Cloud Overview and IAM GCFR Practice Questions (Page 3)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

5concepts

Questions 11–15

11expert · medium
A forensic investigator is analyzing a security incident and needs to determine the exact time a specific IAM policy was changed. The investigator has access to the project's Admin Activity audit logs. Which field in the log entry should the investigator examine?
Select an answer first
12foundation · easy
Which type of IAM role in Google Cloud is defined by the user and allows for the most granular control over permissions?
Select an answer first
13application · medium
An organization uses primitive roles (Owner, Editor, Viewer) for its GCP project. A forensic investigation reveals that a former employee with the Editor role deleted a Cloud Storage bucket. What is the most effective way to prevent this from happening in the future while maintaining necessary access for other users?
Select an answer first
14application · medium
A project has an IAM policy that grants a user the Storage Admin role at the project level. The user is also a member of a group that has the Storage Viewer role at the folder level. What effective permissions does the user have on a bucket in that folder?
Select an answer first
15application · medium
You are investigating a suspected unauthorized access to a Cloud Storage bucket. Which audit log type would provide the most relevant information about who accessed the bucket and when?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Google Cloud Overview and IAM GCFR Practice Questions (Page 3)

Questions 11–15

A forensic investigator is analyzing a security incident and needs to determine the exact time a specific IAM policy was changed. The investigator has access to the project's Admin Activity audit logs. Which field in the log entry should the investigator examine?

Which type of IAM role in Google Cloud is defined by the user and allows for the most granular control over permissions?

A project has an IAM policy that grants a user the Storage Admin role at the project level. The user is also a member of a group that has the Storage Viewer role at the folder level. What effective permissions does the user have on a bucket in that folder?

You are investigating a suspected unauthorized access to a Cloud Storage bucket. Which audit log type would provide the most relevant information about who accessed the bucket and when?

Keep studying — Google Cloud Platform Forensics