A forensic analyst is investigating a malware infection on a GCP VM. They suspect the malware is using DNS to communicate with a command-and-control server. Cloud DNS logs are enabled for the project. Which analysis should the analyst perform to identify the malicious domain?

Review VPC flow logs for connections to port 53 from the VM.

Use gcloud dns record-sets list to see all DNS records in the project.

Check the VM's /etc/hosts file for entries pointing to malicious domains.

Query Cloud DNS logs for queries originating from the VM's IP address and look for unusual or known malicious domains.

An analyst is investigating a DNS tunneling attack. Cloud DNS logs are enabled, but the logs are only stored in Cloud Logging for 30 days. The attack occurred 60 days ago. The analyst needs to identify the malicious domain. Which approach is most likely to recover the DNS query data?

Check if the Cloud DNS logs were exported to BigQuery or Cloud Storage, which may have longer retention.

Review the VM's local DNS cache or hosts file.

Use the Cloud Console's Logs Explorer to search for DNS logs from 60 days ago.

Analyze VPC flow logs to identify DNS queries to external DNS servers.

A forensic investigator needs to understand the network topology of a GCP project to trace how a compromised VM could have reached a database in another VPC. The project has multiple VPCs with VPC peering. Which steps should the investigator take to map the topology?

List all VPC networks, subnets, routes, and firewall rules, and review VPC peering connections.

Review only the firewall rules for the database subnet.

Examine the routes table for the compromised VM's subnet.

Use gcloud compute instances list to see all VMs and their IPs.

GIAC Cloud Forensics Responder

Domain 2Objective 2

Google Cloud Storage and Networking GCFR Practice Questions (Page 3)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

10concepts

Questions 11–15

11application · medium
A forensic analyst is investigating a malware infection on a GCP VM. They suspect the malware is using DNS to communicate with a command-and-control server. Cloud DNS logs are enabled for the project. Which analysis should the analyst perform to identify the malicious domain?
Select an answer first
12foundation · medium
Which field in a load balancer access log indicates the HTTP status code returned to the client?
Select an answer first
13expert · hard
An analyst is investigating a DNS tunneling attack. Cloud DNS logs are enabled, but the logs are only stored in Cloud Logging for 30 days. The attack occurred 60 days ago. The analyst needs to identify the malicious domain. Which approach is most likely to recover the DNS query data?
Select an answer first
14foundation · medium
Which Google Cloud service allows you to capture and mirror network traffic from VM instances for analysis?
Select an answer first
15application · medium
A forensic investigator needs to understand the network topology of a GCP project to trace how a compromised VM could have reached a database in another VPC. The project has multiple VPCs with VPC peering. Which steps should the investigator take to map the topology?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Google Cloud Storage and Networking GCFR Practice Questions (Page 3)

Questions 11–15

A forensic analyst is investigating a malware infection on a GCP VM. They suspect the malware is using DNS to communicate with a command-and-control server. Cloud DNS logs are enabled for the project. Which analysis should the analyst perform to identify the malicious domain?

Which field in a load balancer access log indicates the HTTP status code returned to the client?

An analyst is investigating a DNS tunneling attack. Cloud DNS logs are enabled, but the logs are only stored in Cloud Logging for 30 days. The attack occurred 60 days ago. The analyst needs to identify the malicious domain. Which approach is most likely to recover the DNS query data?

Which Google Cloud service allows you to capture and mirror network traffic from VM instances for analysis?

A forensic investigator needs to understand the network topology of a GCP project to trace how a compromised VM could have reached a database in another VPC. The project has multiple VPCs with VPC peering. Which steps should the investigator take to map the topology?

Keep studying — Google Cloud Platform Forensics