A forensic investigator needs to determine which administrator in a Google Workspace domain changed a user's password two weeks ago. The organization has enabled the Admin audit log and retains it for 30 days. Which action should the investigator take to retrieve this information?

Query the Gmail log for the password change event using the target user's email address.

Review the Drive audit log for the password change event, since password changes are stored with file metadata.

Check the user's Calendar event history for a password reset notification.

Use the Admin console Reports page to filter the Admin audit log by the 'User Settings' activity type and the target user's email address.

An investigator needs to determine whether a user accessed a sensitive document from a mobile device or a desktop. The Drive audit log shows the event, but the user agent string is not visible in the Admin console. What is the best way to obtain the device information?

Use the Reports API to retrieve the full audit event, which includes the user agent

Use the Drive API to list the file's revisions and check the editor's device

Check the Login audit log for the same timestamp to infer the device

Use the Gmail log to see if the user sent an email from the device at that time

A company is required to retain all employee emails for 7 years due to industry regulations. An employee's account is deleted after termination, but the company later discovers that some emails from that account are missing from Vault. What is the most likely cause?

The emails were stored in the user's local PST file

The employee used a personal email client that bypassed Vault

The account was deleted before a legal hold was applied

The emails were deleted before the retention policy was applied

An administrator needs to grant a forensic investigator read-only access to all audit logs and Vault exports, but must not allow the investigator to modify any settings or create new holds. What is the most appropriate way to configure this?

Create a custom admin role with the 'Audit logs' and 'Vault' privileges set to read-only

Use the Reports API to provide the investigator with a custom dashboard

Grant the investigator the 'Super Admin' role and rely on the investigator's integrity

Share the investigator's Google account with the Vault service account

GIAC Cloud Forensics Responder

Domain 3Objective 1

Google Workspace Fundamentals GCFR Practice Questions (Page 6)

Part of the Google Workspace Forensics domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 26–30

26application · medium
A forensic investigator needs to determine which administrator in a Google Workspace domain changed a user's password two weeks ago. The organization has enabled the Admin audit log and retains it for 30 days. Which action should the investigator take to retrieve this information?
Select an answer first
27foundation · easy
In a forensic investigation, which Google Workspace log would be most useful for determining who accessed a specific file in Google Drive and when?
Select an answer first
28expert · hard
An investigator needs to determine whether a user accessed a sensitive document from a mobile device or a desktop. The Drive audit log shows the event, but the user agent string is not visible in the Admin console. What is the best way to obtain the device information?
Select an answer first
29expert · hard
A company is required to retain all employee emails for 7 years due to industry regulations. An employee's account is deleted after termination, but the company later discovers that some emails from that account are missing from Vault. What is the most likely cause?
Select an answer first
30expert · hard
An administrator needs to grant a forensic investigator read-only access to all audit logs and Vault exports, but must not allow the investigator to modify any settings or create new holds. What is the most appropriate way to configure this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.