A company has a project with a folder structure: Folder A contains sensitive data, and Folder B contains non-sensitive data. A forensic investigator needs read access to all resources in Folder A but must not have any access to Folder B. The investigator is currently a member of the Project Viewer role. What is the most appropriate action?

Create a custom role with read permissions and grant it at the project level.

Keep the Project Viewer role and grant the Viewer role on Folder A.

Grant the investigator the Owner role on Folder A.

Remove the investigator from the Project Viewer role and grant the Viewer role on Folder A.

A forensic team is investigating a security incident that involves a compromised service account. The service account has the roles/editor role on a project. To prevent further damage while preserving evidence, what should the team do FIRST?

Disable the service account and revoke its roles

Change the service account's key

Grant the service account the roles/iam.securityReviewer role

Delete the service account immediately

A forensic investigator needs to list all Compute Engine instances in a project to identify potential evidence sources. The investigator has been granted the Viewer role on the project. However, the list call returns an empty result even though instances exist. What is the most likely cause?

The Viewer role does not include compute.instances.list permission.

The investigator's API client is using an outdated authentication token.

The instances are stopped, so they are not visible in the list output.

The instances are in a different region than the investigator's default zone.

Which IAM best practice is most important for forensic investigators to ensure that evidence is not tampered with?

Granting all investigators Owner role to ensure they have full access to all evidence

Sharing a single service account key among the investigation team for simplicity

Using least privilege to grant only the permissions necessary for the investigation

Disabling all audit logs to protect the privacy of the investigation

GIAC Cloud Forensics Responder

Domain 2Objective 1

Google Cloud Overview and IAM GCFR Practice Questions (Page 4)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

5concepts

Questions 16–20

16expert · hard
A company has a project with a folder structure: Folder A contains sensitive data, and Folder B contains non-sensitive data. A forensic investigator needs read access to all resources in Folder A but must not have any access to Folder B. The investigator is currently a member of the Project Viewer role. What is the most appropriate action?
Select an answer first
17expert · hard
A forensic team is investigating a security incident that involves a compromised service account. The service account has the roles/editor role on a project. To prevent further damage while preserving evidence, what should the team do FIRST?
Select an answer first
18application · medium
A forensic investigator needs to list all Compute Engine instances in a project to identify potential evidence sources. The investigator has been granted the Viewer role on the project. However, the list call returns an empty result even though instances exist. What is the most likely cause?
Select an answer first
19expert · hard
A forensic investigator is analyzing a security incident and needs to determine whether a specific user attempted to access a resource they were not authorized to access. Which audit log type should be examined?
Select an answer first
20foundation · easy
Which IAM best practice is most important for forensic investigators to ensure that evidence is not tampered with?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Google Cloud Overview and IAM GCFR Practice Questions (Page 4)

Questions 16–20

A forensic team is investigating a security incident that involves a compromised service account. The service account has the roles/editor role on a project. To prevent further damage while preserving evidence, what should the team do FIRST?

A forensic investigator needs to list all Compute Engine instances in a project to identify potential evidence sources. The investigator has been granted the Viewer role on the project. However, the list call returns an empty result even though instances exist. What is the most likely cause?

A forensic investigator is analyzing a security incident and needs to determine whether a specific user attempted to access a resource they were not authorized to access. Which audit log type should be examined?

Which IAM best practice is most important for forensic investigators to ensure that evidence is not tampered with?

Keep studying — Google Cloud Platform Forensics