Google Cloud Storage and Networking GCFR Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is investigating a data breach where a service account was compromised and used to access a Google Cloud Storage bucket. Cloud Audit Logs are enabled, but the logs are only retained for 30 days. The incident occurred 45 days ago. The team needs to determine which objects were accessed by the compromised service account. What should they do?

   • AQuery the existing Cloud Audit Logs for the service account's activity, even though they are older than 30 days.
   • BCheck the bucket's access logs, if enabled, for the relevant time period.
   • CUse the bucket's IAM policy to see which roles the service account had.
   • DEnable VPC flow logs for the project and analyze traffic to the bucket's IP address.
   Reveal Solution Discussion Select an answer first
2. 32foundation · medium

   Which field in a Cloud DNS log record contains the domain name that was queried?

   • Aquery_name
   • Bprotocol
   • Cresponse_code
   • Dsource_ip
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team suspects that a compromised service account has been reading sensitive objects from a Google Cloud Storage bucket. They have enabled Cloud Audit Logs for the project, but they need to determine which specific objects were accessed and by which principal. What should they do to obtain this information?

   • AQuery Cloud Audit Logs for the bucket's Data Access audit logs, filtering by the service account and the object name.
   • BUse gsutil ls -l gs://bucket/ to list objects and their last access times.
   • CReview the bucket's IAM policy to see which roles the service account has.
   • DEnable VPC flow logs for the subnet that hosts the bucket and analyze the traffic to the bucket's IP address.
   Reveal Solution Discussion Select an answer first
5. 34foundation · medium

   Which Google Cloud load balancer log type provides detailed information about client requests and responses?

   • AAudit logs
   • BSystem logs
   • CFlow logs
   • DAccess logs
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A forensic analyst is investigating a compromised VM in a GCP VPC. They need to determine whether the VM communicated with a known command-and-control server on the internet. VPC flow logs are enabled for the subnet. Which analysis should the analyst perform?

   • AExamine the VM's firewall rules to see if outbound traffic to the C2 IP is allowed.
   • BReview Cloud DNS logs for queries to the C2 domain.
   • CQuery VPC flow logs for the VM's network interface, filtering for connections to the C2 IP address and port.
   • DUse gcloud compute instances describe to check the VM's network tags and external IP.
   Reveal Solution Discussion Select an answer first