A forensic investigator needs to identify when a specific user last logged into their Google Workspace account and from which IP address. The organization has enabled the necessary audit logs. Which report should the investigator consult?

The Calendar audit log for event creation.

The Gmail log for the user's email activity.

The Login audit log in the Admin console Reports section.

The Drive audit log for file access events.

An organization wants to enforce two-factor authentication for all users in their Google Workspace domain. Which setting should be configured in the Admin console?

Enable 'Require 2-Step Verification' in the Security settings for the organizational unit.

Enable 'Less secure apps' access.

Set the password policy to require 12 characters.

Configure the Gmail spam filter to block suspicious emails.

An administrator needs to identify all users who logged into Google Workspace from an IP address associated with a known threat actor during the past week. Which log or API should be used?

Drive audit log to see file access from that IP

Admin console's Admin audit log for user account changes

Admin console's Login audit log or the Reports API's login activity report

Gmail log search to find emails sent from that IP

An investigator needs to retrieve the IP address from which a user sent a specific email. Which API or log should be used?

The Admin SDK Reports API, using the activities.list method for Gmail logs.

The Calendar API, using the events.get method.

The Gmail API, using the messages.get method to retrieve the message headers.

The Drive API, using the files.get method to retrieve the email file.

GIAC Cloud Forensics Responder

Domain 3Objective 1

Google Workspace Fundamentals GCFR Practice Questions (Page 3)

Part of the Google Workspace Forensics domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 11–15

11application · medium
A forensic investigator needs to identify when a specific user last logged into their Google Workspace account and from which IP address. The organization has enabled the necessary audit logs. Which report should the investigator consult?
Select an answer first
12application · medium
An organization wants to enforce two-factor authentication for all users in their Google Workspace domain. Which setting should be configured in the Admin console?
Select an answer first
13application · medium
An administrator needs to identify all users who logged into Google Workspace from an IP address associated with a known threat actor during the past week. Which log or API should be used?
Select an answer first
14foundation · easy
Which Google Workspace tool is the central console for administrators to manage users, devices, and security settings for an organization's domain?
Select an answer first
15application · medium
An investigator needs to retrieve the IP address from which a user sent a specific email. Which API or log should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.