A security analyst is investigating a DDoS attack against a web application behind a Google Cloud load balancer. The load balancer logs show a high volume of requests from a small set of IP addresses. The analyst needs to determine whether the attack originated from the internet or from within the VPC. Which data source should they examine?

Load balancer logs alone, since they include the client IP.

VPC flow logs for the load balancer's backend subnets to see if the source IPs are internal.

Cloud DNS logs to see if the attacker resolved the load balancer's domain.

Firewall rules to see if the source IPs are allowed.

A forensic analyst is investigating a lateral movement incident in a GCP environment. They have VPC flow logs for all subnets, but the logs are only sampled at a rate of 50%. The analyst needs to determine whether a compromised VM communicated with a database VM in a different subnet. Which approach is most reliable?

Use Cloud Packet Mirroring to capture traffic between the two VMs in real time.

Examine the database VM's audit logs for connections from the compromised VM's IP.

Review firewall rules to see if traffic between the subnets is allowed.

Analyze the VPC flow logs for connections between the two VMs' IPs, accepting that sampling may miss some connections.

An investigator needs to capture raw network packets of traffic between a compromised VM and a suspicious external host. The VM is running a production workload and cannot be stopped. The organization uses VPC flow logs but needs full packet contents. Which approach should the investigator use?

Use VPC flow logs to reconstruct the full packet contents.

Create a snapshot of the VM's disk and analyze the network traffic from the snapshot.

Enable Cloud Packet Mirroring on the VM's subnet and mirror traffic to a collector VM in the same VPC.

Run tcpdump on the compromised VM to capture packets to a local file.

GIAC Cloud Forensics Responder

Domain 2Objective 2

Google Cloud Storage and Networking GCFR Practice Questions (Page 5)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

10concepts

Questions 21–25

21foundation · medium
Which Google Cloud service provides audit logs that record administrative actions and data access on Cloud Storage resources?
Select an answer first
22expert · hard
A security analyst is investigating a DDoS attack against a web application behind a Google Cloud load balancer. The load balancer logs show a high volume of requests from a small set of IP addresses. The analyst needs to determine whether the attack originated from the internet or from within the VPC. Which data source should they examine?
Select an answer first
23expert · hard
A forensic analyst is investigating a lateral movement incident in a GCP environment. They have VPC flow logs for all subnets, but the logs are only sampled at a rate of 50%. The analyst needs to determine whether a compromised VM communicated with a database VM in a different subnet. Which approach is most reliable?
Select an answer first
24foundation · medium
Which Google Cloud service provides a dedicated physical connection between an on-premises network and a VPC, without using the public internet?
Select an answer first
25application · medium
An investigator needs to capture raw network packets of traffic between a compromised VM and a suspicious external host. The VM is running a production workload and cannot be stopped. The organization uses VPC flow logs but needs full packet contents. Which approach should the investigator use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Google Cloud Storage and Networking GCFR Practice Questions (Page 5)

Questions 21–25

Which Google Cloud service provides audit logs that record administrative actions and data access on Cloud Storage resources?

Which Google Cloud service provides a dedicated physical connection between an on-premises network and a VPC, without using the public internet?

An investigator needs to capture raw network packets of traffic between a compromised VM and a suspicious external host. The VM is running a production workload and cannot be stopped. The organization uses VPC flow logs but needs full packet contents. Which approach should the investigator use?

Keep studying — Google Cloud Platform Forensics