A web application behind a Google Cloud load balancer is suspected of being probed by an attacker. The load balancer logs are enabled. Which analysis should the analyst perform to identify the attacker's IP and the requests they made?

Review VPC flow logs for connections to the load balancer's frontend IP.

Use gcloud compute forwarding-rules describe to see the load balancer's IP.

Check the backend VM's access logs for requests.

Query the load balancer logs for requests with unusual user agents or high request rates from a single IP.

An incident responder needs to capture network traffic between two VMs in the same VPC to analyze an ongoing attack. The VMs are in different subnets and the responder has access to the project. Which method should they use to capture the traffic?

Run tcpdump on one of the VMs to capture traffic on its network interface.

Use gcloud compute ssh to the source VM and run a packet capture tool on the other VM.

Enable VPC flow logs for the subnets and analyze the logs.

Configure Cloud Packet Mirroring to mirror traffic from the source VM's interface to a collector VM.

What is the purpose of VPC peering in Google Cloud?

To log all network traffic between VPCs

To connect two VPC networks so that resources can communicate using private IP addresses

To create a public IP address for a VM

To provide a VPN connection to on-premises networks

When acquiring a Google Cloud Storage bucket for forensic analysis, which approach preserves the original object metadata and content integrity?

Use gsutil cp -p to copy objects preserving metadata and then generate hashes

Use gsutil rsync to synchronize the bucket to a local directory

Use gcloud storage buckets describe to export bucket metadata

Use gsutil cp -r to copy the bucket to a local disk

GIAC Cloud Forensics Responder

Domain 2Objective 2

Google Cloud Storage and Networking GCFR Practice Questions (Page 1)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

10concepts

Questions 1–5

1application · medium
A web application behind a Google Cloud load balancer is suspected of being probed by an attacker. The load balancer logs are enabled. Which analysis should the analyst perform to identify the attacker's IP and the requests they made?
Select an answer first
2application · medium
An incident responder needs to capture network traffic between two VMs in the same VPC to analyze an ongoing attack. The VMs are in different subnets and the responder has access to the project. Which method should they use to capture the traffic?
Select an answer first
3foundation · medium
What is the purpose of VPC peering in Google Cloud?
Select an answer first
4foundation · medium
When acquiring a Google Cloud Storage bucket for forensic analysis, which approach preserves the original object metadata and content integrity?
Select an answer first
5foundation · medium
What is the default action for a Google Cloud VPC firewall rule if no rule matches a packet?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.