An investigator needs to retrieve a list of all users who have access to a specific Google Drive file, including external users. The investigator has been granted the necessary OAuth scopes. Which API call should be used?

Drive API files.get with the file ID and 'fields=permissions'.

Drive API permissions.list with the file ID.

Admin SDK Reports API activities.list with the file ID.

Drive API files.list with 'q' set to the file name.

A user reports that a file in Google Drive was overwritten by a collaborator and the original content is needed for an investigation. The organization has Vault with Drive retention enabled. What is the most reliable way to recover the original version?

Use Vault to export the file's current version and hope the original is included

Check the Drive audit log for the overwrite event and then use the Gmail API to find an email attachment of the original

Use the Admin console to restore the file from the user's trash

Use the Drive API to list file revisions and download the earlier revision

A company is preparing for litigation and needs to preserve all Google Workspace data for a specific user, including Gmail, Drive, and Calendar, while preventing the user from permanently deleting any data. The legal team also wants a record of who placed the hold. What should the administrator do?

Set a custom retention rule in Vault for 10 years and rely on the Drive audit log to track deletions

Apply a litigation hold to the user in Google Vault and check the Admin audit log for the hold action

Disable the user's account and export all data using Google Takeout

Create an OU with retention enabled and move the user into it, then use the Reports API to audit the move

An organization is investigating a data breach and needs to determine whether an administrator used a privileged account to access another user's mailbox. The organization has enabled Gmail logs and Admin audit logs. What is the most reliable way to identify this activity?

Use the Reports API to pull the user's usage report and look for anomalies

Review the Admin audit log for 'Gmail mailbox access' events and correlate with the Gmail log for the target user

Use the Drive audit log to see if the admin accessed files in the user's Drive

Review the Login audit log for the admin's login and assume they accessed the mailbox

GIAC Cloud Forensics Responder

Domain 3Objective 1

Google Workspace Fundamentals GCFR Practice Questions (Page 7)

Part of the Google Workspace Forensics domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 31–35

31expert · hard
An investigator needs to retrieve a list of all users who have access to a specific Google Drive file, including external users. The investigator has been granted the necessary OAuth scopes. Which API call should be used?
Select an answer first
32application · medium
A user reports that a file in Google Drive was overwritten by a collaborator and the original content is needed for an investigation. The organization has Vault with Drive retention enabled. What is the most reliable way to recover the original version?
Select an answer first
33foundation · easy
Which type of Google Workspace log records administrative actions such as creating a user, changing a password, or updating an organizational unit?
Select an answer first
34application · medium
A company is preparing for litigation and needs to preserve all Google Workspace data for a specific user, including Gmail, Drive, and Calendar, while preventing the user from permanently deleting any data. The legal team also wants a record of who placed the hold. What should the administrator do?
Select an answer first
35expert · hard
An organization is investigating a data breach and needs to determine whether an administrator used a privileged account to access another user's mailbox. The organization has enabled Gmail logs and Admin audit logs. What is the most reliable way to identify this activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.