A Google Cloud VM failed to boot after a kernel update. The investigator needs to see the boot messages to determine if the kernel panic occurred before the operating system fully loaded. Which action should the investigator take?

Review the VPC flow logs for the instance's network traffic.

Examine the instance's disk snapshot for the kernel files.

Check the instance's systemd journal via SSH.

Use the Google Cloud Console to view the serial port 1 (console) output for the instance.

An incident responder needs to preserve the state of a VM that was created by a managed instance group (MIG). The VM is currently running and the MIG has autoscaling enabled. What is the most appropriate forensic action to preserve the VM's disk?

Create a snapshot of the VM's disk immediately

Disable autoscaling and then create a snapshot

Attach the disk to another VM and copy it

Delete the VM from the MIG and then snapshot the disk

A security analyst suspects that an attacker added an unauthorized SSH key to a VM. The VM uses OS Login. Which step should the analyst take to determine if the key was added through OS Login or directly to the instance metadata?

Review the VM's serial console output for SSH login attempts

Compare the instance metadata's SSH keys with the OS Login keys for the user

Examine the VPC flow logs for SSH connections

Check the OS Login user accounts in the project's IAM policy

To preserve the state of a Google Cloud VM's disk for forensic analysis without affecting the running instance, which action should you take?

Stop the VM and then copy the disk

Create a snapshot of the persistent disk

Where can a forensic investigator find the startup script that was executed when a Google Cloud VM was launched?

In the instance metadata under 'startup-script'

In the VM's serial console output

GIAC Cloud Forensics Responder

Domain 2Objective 3

Google Cloud Virtual Machines GCFR Practice Questions (Page 6)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

12concepts

Questions 26–30

26application · medium
A Google Cloud VM failed to boot after a kernel update. The investigator needs to see the boot messages to determine if the kernel panic occurred before the operating system fully loaded. Which action should the investigator take?
Select an answer first
27application · medium
An incident responder needs to preserve the state of a VM that was created by a managed instance group (MIG). The VM is currently running and the MIG has autoscaling enabled. What is the most appropriate forensic action to preserve the VM's disk?
Select an answer first
28application · medium
A security analyst suspects that an attacker added an unauthorized SSH key to a VM. The VM uses OS Login. Which step should the analyst take to determine if the key was added through OS Login or directly to the instance metadata?
Select an answer first
29foundation · easy
To preserve the state of a Google Cloud VM's disk for forensic analysis without affecting the running instance, which action should you take?
Select an answer first
30foundation · easy
Where can a forensic investigator find the startup script that was executed when a Google Cloud VM was launched?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.