Google Cloud Virtual Machines GCFR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which Google Cloud persistent disk type offers the highest performance for transactional workloads with low latency?

   • ABalanced persistent disk (pd-balanced)
   • BStandard persistent disk (pd-standard)
   • CSSD persistent disk (pd-ssd)
   • DExtreme persistent disk (pd-extreme)
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Google Cloud VM was live-migrated to another host during a maintenance event. An investigator needs to ensure that the memory evidence from the VM is preserved. Which statement accurately describes the forensic implication of live migration?

   • ALive migration transfers the VM's memory contents to the new host, potentially altering the memory state.
   • BLive migration only affects disk storage, not memory.
   • CLive migration does not affect memory evidence because the VM is paused during migration.
   • DLive migration preserves the exact memory state because the VM continues running.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A managed instance group (MIG) in Google Cloud is configured with an instance template that includes a startup script. During an incident, the MIG automatically replaced a compromised VM. The investigator needs to understand why the VM was replaced and what configuration the new VM received. Which of the following should the investigator review?

   • AThe Cloud Monitoring alerting policies for the MIG.
   • BThe serial console output of the deleted VM.
   • CThe VPC flow logs for the deleted VM.
   • DThe instance group's current instance list and the instance template's metadata.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which Cloud Logging log type records administrative actions such as creating, stopping, or deleting a VM?

   • AFirewall logs
   • BSerial console logs
   • CAudit logs
   • DVPC flow logs
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic investigator is analyzing a compromised Google Cloud VM. The attacker is known to have used the instance's metadata server to retrieve credentials and then deleted the VM. The investigator needs to recover the metadata that was present at the time of the incident. Which approach should the investigator take?

   • ARestore the VM from the latest snapshot and query its metadata server.
   • BCheck the Cloud Logging audit logs for the instance's metadata.set and instances.insert entries.
   • CAccess the serial console output logs for the deleted instance to find the metadata.
   • DUse gcloud compute instances describe on the deleted instance ID to retrieve its metadata.
   Reveal Solution Discussion Select an answer first