An administrator needs to enforce a policy that requires two-step verification for all users in the domain. Where would this setting be configured?

In the Google Vault retention rules

In the Google Admin console under Security settings

In the Google Drive settings for the shared drive

A forensic investigator needs to determine whether an administrator reset a user's password and whether that reset occurred before or after a suspicious login. Which audit log should be examined?

Drive audit log for file access around the time of the login

Gmail log search for password reset notifications

Login audit log for the user's login attempts

Admin audit log for user account changes

A forensic investigator needs to export a user's entire Google Drive, including files in the trash and files shared with the user, while preserving metadata such as permissions and timestamps. The user has a litigation hold in place. What is the most efficient method?

Use Google Takeout to export the user's Drive data

Use the Drive API to enumerate all files, including trashed files, and download each with its metadata

Use the Admin console to transfer the user's files to another account and then export

Use Google Vault to export the user's Drive data, which includes trashed files and metadata

A forensic investigator needs to produce all emails sent by a user during a specific date range, including emails that the user deleted from the trash. The organization uses Google Workspace with Vault. What is the most appropriate method to retrieve this data?

Use the Drive API to search for email attachments stored in Drive

Use Google Vault to create an export of the user's Gmail messages for the date range

Use the Gmail API to search the user's mailbox for messages in the date range

Use the Admin console's Gmail log search to find message metadata and then retrieve each message via the Gmail API

GIAC Cloud Forensics Responder

Domain 3Objective 1

Google Workspace Fundamentals GCFR Practice Questions (Page 1)

Part of the Google Workspace Forensics domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 1–5

1foundation · easy
An administrator needs to enforce a policy that requires two-step verification for all users in the domain. Where would this setting be configured?
Select an answer first
2foundation · easy
Which Google Workspace feature allows an administrator to preserve all data for a specific user indefinitely, even if the user's account is deleted, to meet legal obligations?
Select an answer first
3application · medium
A forensic investigator needs to determine whether an administrator reset a user's password and whether that reset occurred before or after a suspicious login. Which audit log should be examined?
Select an answer first
4expert · hard
A forensic investigator needs to export a user's entire Google Drive, including files in the trash and files shared with the user, while preserving metadata such as permissions and timestamps. The user has a litigation hold in place. What is the most efficient method?
Select an answer first
5application · medium
A forensic investigator needs to produce all emails sent by a user during a specific date range, including emails that the user deleted from the trash. The organization uses Google Workspace with Vault. What is the most appropriate method to retrieve this data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.