Google Cloud Overview and IAM GCFR Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   During an investigation, you discover that a user was granted the roles/iam.securityAdmin role on a project, but the audit logs do not show the grant event. What is the most likely reason for this discrepancy?

   • AThe audit logs were exported to a different project
   • BThe audit logs were disabled for the project
   • CThe user already had the role through a group membership
   • DThe role was granted at the folder or organization level, not the project level
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic team is investigating a breach that involved a service account key being stolen. To prevent future incidents, which IAM best practice should be implemented?

   • ADisable audit logging for the service account to reduce noise.
   • BStore the service account key in the source code repository for easy access.
   • CRotate service account keys regularly and use short-lived credentials where possible.
   • DGrant the service account the Owner role to simplify management.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following best describes the purpose of Google Cloud's global infrastructure in the context of cloud forensics?

   • AIt defines the physical locations (regions and zones) where resources run, which determines data residency and the applicable legal jurisdiction for forensic collection.
   • BIt provides a single global network that allows forensic investigators to access any VM from any location without additional configuration.
   • CIt allows forensic investigators to bypass IAM policies when collecting evidence from resources in different regions.
   • DIt ensures that all forensic data is automatically replicated to multiple regions for redundancy.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A forensic investigator needs to collect evidence from a GCP environment that uses multiple projects and regions. The investigator must ensure that the evidence is preserved in a way that is admissible in court. Which approach best meets this requirement?

   • AUse Cloud Asset Inventory to export all resource configurations
   • BUse gcloud commands to export resources to local files
   • CUse a third-party forensic tool that integrates with GCP APIs
   • DUse Cloud Audit Logs and export them to a Cloud Storage bucket with object versioning enabled
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A forensic analyst needs to collect disk snapshots from a compromised project. The analyst should be able to create snapshots but not delete them or modify the source instances. Which IAM role should be assigned?

   • ACompute Storage Admin
   • BCompute Snapshot User
   • CCompute Viewer
   • DCompute Instance Admin
   Reveal Solution Discussion Select an answer first