In a SaaS application, a user's account is compromised and the attacker modifies data. The company needs to determine what changes were made. Which evidence source is most likely to provide this information?

Network flow logs from the customer's on-premises firewall

Application audit logs that record user actions

Memory dumps from the user's device

Hypervisor logs from the underlying infrastructure

In the shared responsibility model, which of the following is typically the customer's responsibility in an IaaS environment?

Physical security of the data center

Securing the guest operating system and applications

Network infrastructure maintenance

A company uses a public IaaS cloud. A compromised web server VM is identified. The incident response team needs to collect volatile memory evidence. What is the most practical approach?

Use the cloud provider's console to capture a memory dump of the VM.

SSH into the VM and run a memory acquisition tool to capture RAM.

Request the hypervisor-level memory dump from the provider.

Take a snapshot of the VM's disk to preserve memory.

GIAC Cloud Forensics Responder

Domain 1Objective 1

Introduction to Cloud DFIR GCFR Practice Questions (Page 2)

Part of the Cloud DFIR Foundations domain, which makes up ~8% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–10 in this domain), expect 6–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 6–10

6foundation · easy
Which characteristic of cloud environments is a key forensic challenge because it can cause evidence to be lost or overwritten quickly?
Select an answer first
7foundation · easy
Which step of the cloud incident response process involves restoring affected cloud services to a known good state while preserving evidence?
Select an answer first
8application · medium
In a SaaS application, a user's account is compromised and the attacker modifies data. The company needs to determine what changes were made. Which evidence source is most likely to provide this information?
Select an answer first
9foundation · easy
In the shared responsibility model, which of the following is typically the customer's responsibility in an IaaS environment?
Select an answer first
10application · medium
A company uses a public IaaS cloud. A compromised web server VM is identified. The incident response team needs to collect volatile memory evidence. What is the most practical approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Introduction to Cloud DFIR GCFR Practice Questions (Page 2)

Questions 6–10

Which characteristic of cloud environments is a key forensic challenge because it can cause evidence to be lost or overwritten quickly?

Which step of the cloud incident response process involves restoring affected cloud services to a known good state while preserving evidence?

In a SaaS application, a user's account is compromised and the attacker modifies data. The company needs to determine what changes were made. Which evidence source is most likely to provide this information?

In the shared responsibility model, which of the following is typically the customer's responsibility in an IaaS environment?

A company uses a public IaaS cloud. A compromised web server VM is identified. The incident response team needs to collect volatile memory evidence. What is the most practical approach?

Keep studying — Cloud DFIR Foundations