Google Cloud Overview and IAM GCFR Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During an investigation, you need to determine who granted a specific user the Storage Object Admin role on a bucket. Which audit log should you examine?

   • APolicy Denied audit log
   • BData Access audit log
   • CAdmin Activity audit log
   • DSystem Event audit log
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A forensic team is investigating a breach that involved a compromised service account. The service account had the Owner role on a project. The team needs to determine what actions the service account performed. Which audit log type would provide the most comprehensive information?

   • AData Access audit log
   • BAdmin Activity audit log
   • CBoth Admin Activity and Data Access audit logs
   • DSystem Event audit log
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A forensic investigator needs to understand the relationship between GCP core services and forensic evidence. Which statement is accurate?

   • ACloud Storage buckets are a common source of forensic evidence because they store objects that may include logs, files, and user uploads.
   • BCompute Engine instances store all forensic evidence in Cloud Storage by default.
   • CBigQuery tables are the only GCP service that can be used to store forensic evidence.
   • DCloud Functions automatically retain execution logs for forensic analysis for 10 years.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which type of Cloud Audit Log records activities related to IAM permissions, such as granting or revoking roles?

   • AData Access audit logs
   • BPolicy Denied audit logs
   • CAdmin Activity audit logs
   • DSystem Event audit logs
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is investigating a potential privilege escalation. The analyst needs to identify all IAM policies that grant the roles/iam.securityAdmin role to any user in the organization. Which tool or method should the analyst use?

   • AUse the gcloud command to get the IAM policy for the organization and parse it
   • BUse the Cloud Console IAM page to manually review each project
   • CCheck the audit logs for role grants
   • DUse the Cloud Asset Inventory to search for IAM policies across the organization
   Reveal Solution Discussion Select an answer first