A forensic investigator is examining a case where a user's Google Workspace account was compromised. The investigator needs to determine if the attacker accessed the user's Gmail, Drive, or Calendar. Which audit logs should be reviewed?

Review the Login audit log for the user's activity.

Review the Admin audit log for the user's activity.

Review the Device audit log for the user's activity.

Review the Gmail log, Drive audit log, and Calendar audit log for the user's activity.

A company is under a legal hold for a specific user's Google Drive files. The investigator needs to ensure that the user's files are preserved even if the user attempts to delete them. Which action should be taken in the Google Admin console?

Disable the user's account to prevent access to Drive.

Change the user's password to prevent them from deleting files.

Set the user's Drive storage quota to zero to prevent new file creation.

Place a litigation hold on the user's Drive using the Google Vault service.

In Google Workspace, how is data in Gmail primarily organized and accessed by users?

As a flat database of messages accessible only through the Gmail mobile app

As a collection of messages organized by labels and searchable via the Gmail interface

As a hierarchical folder structure stored on the user's local device

As individual files stored in Google Drive that users open with a mail client

An organization is investigating a security incident where a user's account was compromised. The investigator needs to determine if the attacker used a new device to access the account. Which Admin console report should be examined?

The Login audit log, which records IP addresses and timestamps.

The Admin audit log, which records admin actions.

The Device audit log, which records device details and login events.

The Gmail log, which records email activity.

GIAC Cloud Forensics Responder

Domain 3Objective 1

Google Workspace Fundamentals GCFR Practice Questions (Page 2)

Part of the Google Workspace Forensics domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 6–10

6expert · hard
A forensic investigator is examining a case where a user's Google Workspace account was compromised. The investigator needs to determine if the attacker accessed the user's Gmail, Drive, or Calendar. Which audit logs should be reviewed?
Select an answer first
7foundation · easy
Which Google Workspace service is the primary storage for user-created documents, spreadsheets, and presentations that are not email attachments?
Select an answer first
8application · medium
A company is under a legal hold for a specific user's Google Drive files. The investigator needs to ensure that the user's files are preserved even if the user attempts to delete them. Which action should be taken in the Google Admin console?
Select an answer first
9foundation · easy
In Google Workspace, how is data in Gmail primarily organized and accessed by users?
Select an answer first
10expert · hard
An organization is investigating a security incident where a user's account was compromised. The investigator needs to determine if the attacker used a new device to access the account. Which Admin console report should be examined?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.