What is live migration in Google Cloud?

Copying a VM's disk to another region

Creating a snapshot of a running VM

Moving a VM to another zone without downtime

Restarting a VM after a failure

An investigator is tracing the network activity of a compromised Google Cloud VM. The VM has both an internal and an external IP address. The investigator wants to identify which external IP addresses communicated with the VM over the past week. Which data source should the investigator analyze?

The instance's metadata for external IP assignment.

The VM's serial console output.

Cloud Monitoring metrics for the VM's CPU utilization.

VPC flow logs for the VM's subnet.

An analyst is investigating a VM that was used to launch a crypto-mining attack. The VM was created from an instance template that included a startup script. The analyst wants to retrieve the exact startup script that was used. Where should the analyst look?

In the instance template's metadata

In the VM's instance metadata under the key 'startup-script'

In the Cloud Storage bucket referenced by the template

A forensic investigator needs to acquire the memory of a running Google Cloud VM for analysis. The VM is running a production service and cannot be stopped. Which method should the investigator use?

Use the Google Cloud Console to trigger a memory dump from the VM's monitoring page.

SSH into the VM and use a tool like LiME to capture memory.

Use gcloud compute instances export to download the memory image.

Create a snapshot of the VM's persistent disk and extract memory from it.

GIAC Cloud Forensics Responder

Domain 2Objective 3

Google Cloud Virtual Machines GCFR Practice Questions (Page 3)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

12concepts

Questions 11–15

11foundation · easy
What is live migration in Google Cloud?
Select an answer first
12application · medium
An investigator is tracing the network activity of a compromised Google Cloud VM. The VM has both an internal and an external IP address. The investigator wants to identify which external IP addresses communicated with the VM over the past week. Which data source should the investigator analyze?
Select an answer first
13application · medium
An analyst is investigating a VM that was used to launch a crypto-mining attack. The VM was created from an instance template that included a startup script. The analyst wants to retrieve the exact startup script that was used. Where should the analyst look?
Select an answer first
14foundation · easy
When examining a VM's network configuration, which attribute identifies the VM's private IP address within its VPC network?
Select an answer first
15application · medium
A forensic investigator needs to acquire the memory of a running Google Cloud VM for analysis. The VM is running a production service and cannot be stopped. Which method should the investigator use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.