GIAC Cloud Forensics Responder
Domain 2Objective 3
Google Cloud Virtual Machines GCFR Practice Questions (Page 7)
Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)
41questions here
9free pages
12concepts
Questions 31–35
- 31
A managed instance group (MIG) in Google Cloud is configured with an instance template that includes a startup script. The startup script downloads and executes a binary from a URL. An incident responder discovers that the binary is malicious. The MIG has already replaced several instances. The responder needs to determine the scope of the compromise and preserve evidence. Which combination of actions should the responder take?
Select an answer first - 32
When a VM is migrated to a different zone, what happens to its persistent disks?
Select an answer first - 33
Which of the following is an example of an instance attribute that can be used as forensic evidence when investigating a Google Cloud VM?
Select an answer first - 34
Which Google Cloud feature allows you to view the output of a VM's serial console, which can include boot logs and kernel messages?
Select an answer first - 35
When investigating SSH key management on a Google Cloud VM, where can you find the SSH keys that are authorized for the instance?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.