A security team is investigating a potential data exfiltration incident. They need to determine if a user shared a sensitive document outside the organization via Google Drive. Which audit log should they examine?

The Admin audit log, filtering for 'User Settings' changes.

The Drive audit log, filtering for 'External Sharing' events.

The Login audit log, filtering for the user's IP address.

The Gmail log, filtering for sent messages with attachments.

An investigator is analyzing a data exfiltration incident where a user shared a sensitive file externally via Google Drive. The organization has enabled Drive audit logs, but the logs only show the event type and timestamp, not the recipient's email address. Which additional source should the investigator use to identify the external recipient?

The Calendar audit log to find a meeting invitation sent to the recipient.

The Admin audit log to find the sharing event details.

The Login audit log to find the recipient's IP address.

The Gmail log to find an email notification sent to the external recipient about the file share.

An investigator needs to retrieve the metadata of a Google Calendar event, including the list of attendees and the event's creation time, for a forensic case. Which API should be used?

The Google Calendar API, using the events.get method.

The Drive API, using the files.get method.

The Admin SDK Reports API, using the activities.list method.

The Gmail API, using the messages.get method.

A legal hold has been placed on a user's Google Workspace data. The user later leaves the company and the account is deleted. What happens to the data under the legal hold?

The data is transferred to the domain administrator's account

The data remains preserved in Vault and can be exported by an administrator

The data is permanently deleted and cannot be recovered

The data is archived to Google Takeout for the legal team

GIAC Cloud Forensics Responder

Domain 3Objective 1

Google Workspace Fundamentals GCFR Practice Questions (Page 4)

Part of the Google Workspace Forensics domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 16–20

16application · medium
A security team is investigating a potential data exfiltration incident. They need to determine if a user shared a sensitive document outside the organization via Google Drive. Which audit log should they examine?
Select an answer first
17expert · hard
An investigator is analyzing a data exfiltration incident where a user shared a sensitive file externally via Google Drive. The organization has enabled Drive audit logs, but the logs only show the event type and timestamp, not the recipient's email address. Which additional source should the investigator use to identify the external recipient?
Select an answer first
18application · medium
An investigator needs to retrieve the metadata of a Google Calendar event, including the list of attendees and the event's creation time, for a forensic case. Which API should be used?
Select an answer first
19application · medium
A legal hold has been placed on a user's Google Workspace data. The user later leaves the company and the account is deleted. What happens to the data under the legal hold?
Select an answer first
20foundation · easy
Which Google Workspace API would a forensic investigator use to programmatically retrieve a list of all users in a domain, including their status and last login time?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Google Workspace Fundamentals GCFR Practice Questions (Page 4)

Questions 16–20

A security team is investigating a potential data exfiltration incident. They need to determine if a user shared a sensitive document outside the organization via Google Drive. Which audit log should they examine?

An investigator needs to retrieve the metadata of a Google Calendar event, including the list of attendees and the event's creation time, for a forensic case. Which API should be used?

A legal hold has been placed on a user's Google Workspace data. The user later leaves the company and the account is deleted. What happens to the data under the legal hold?

Which Google Workspace API would a forensic investigator use to programmatically retrieve a list of all users in a domain, including their status and last login time?

Keep studying — Google Workspace Forensics