Google Cloud Storage and Networking GCFR Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An application behind an HTTPS load balancer experienced a spike in 502 errors. The load balancer logs are enabled. The investigator needs to determine whether the errors were caused by the backend rejecting requests or by the load balancer itself. Which field in the load balancer log would be most useful?

   • AThe backend name field, to see which backend was targeted.
   • BThe statusDetails field, which indicates whether the error came from the backend or the load balancer.
   • CThe requestLatency field, which shows how long the backend took to respond.
   • DThe client IP field, to see if the errors came from a specific source.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is investigating a potential malware infection. Cloud DNS logging is enabled for the VPC. The analyst suspects that a VM resolved a known malicious domain. Which log entry would provide the most direct evidence of the DNS query?

   • AA firewall rule log entry showing the VM's outbound traffic to port 53.
   • BA VPC flow log entry showing the VM's IP connecting to the malicious domain's IP address.
   • CA Cloud Audit Log entry for the DNS service showing who created the DNS zone.
   • DA Cloud DNS log entry showing the query name, the VM's source IP, and the response.
   Reveal Solution Discussion Select an answer first
4. 18foundation · medium

   Which type of Cloud Audit Log records read operations on Cloud Storage objects, such as object gets?

   • ASystem Event audit logs
   • BPolicy Denied audit logs
   • CAdmin Activity audit logs
   • DData Access audit logs
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During an incident response, you discover that a VM in a private subnet was accessed from the internet. The VPC has a firewall rule that allows ingress from 0.0.0.0/0 to TCP port 22. You need to determine whether the firewall rule was the actual path used, or if another mechanism allowed the traffic. Which evidence source would most directly confirm the firewall rule was the enabler?

   • AExamine the firewall rule's change history in Cloud Audit Logs to see when it was created.
   • BReview the VPC flow logs for the VM to see if traffic on TCP port 22 from an external IP was allowed and logged.
   • CUse the Cloud Console's firewall rules list to verify the rule is still in effect.
   • DCheck the VM's OS-level auth logs to see if a successful SSH login occurred.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A forensic investigator is examining a GCS bucket that was used to exfiltrate data. The bucket has versioning enabled, and the investigator needs to determine exactly when a specific object version was deleted and by which principal. The organization has not enabled Cloud Audit Logs for the bucket. Which combination of actions will provide the most reliable evidence of the deletion event?

   • AQuery the bucket's access logs (storage logs) for the deletion timestamp and principal, and use the object's generation number to correlate with the log entry.
   • BUse the gcloud storage objects describe command on the deleted object's name to retrieve its deletion metadata.
   • CEnable Cloud Audit Logs retroactively for the bucket, then query the logs for the delete event.
   • DUse the gcloud storage ls --all-versions command to list all versions, then check the bucket's lifecycle management rules to infer deletion time.
   Reveal Solution Discussion Select an answer first