A forensic investigator is examining a serverless function in a PaaS environment. The function processed sensitive data and has already been invoked multiple times. Which evidence source is most likely to provide historical execution details?

Platform-provided execution logs and function metadata

Network packet captures from the provider's internal network

A memory dump from the function's underlying container

A snapshot of the function's virtual disk

A company uses a SaaS collaboration tool. An employee's account is compromised, and the attacker accessed sensitive files. The company needs to preserve evidence for a potential lawsuit. The provider offers eDiscovery export but only for the last 30 days. The incident occurred 45 days ago. What is the best course of action?

Ask the provider for a raw disk image of the collaboration server.

Contact the provider immediately to request a legal hold and ask if older data can be recovered from backups.

Accept that the data is lost because the provider's retention policy has passed.

Use the company's own local cache of the collaboration tool to reconstruct the data.

A multinational company stores customer data in a public cloud region in the EU. A US-based law enforcement agency requests access to the data for an investigation. Which factor is most important for the company to consider before responding?

The data residency and applicable legal jurisdiction of the region where the data is stored

The company's internal incident response playbook

The cloud provider's internal data retention policy

The type of cloud deployment model (public vs. private)

Which cloud deployment model allows an organization to keep sensitive workloads in a dedicated environment while using shared resources for less critical processing, and what is a key DFIR implication?

Community cloud; evidence is shared among all member organizations

Private cloud; forensic data is always on-premises

Hybrid cloud; investigators must correlate evidence across both environments

Public cloud; forensic data is always accessible to law enforcement

GIAC Cloud Forensics Responder

Domain 1Objective 1

Introduction to Cloud DFIR GCFR Practice Questions (Page 4)

Part of the Cloud DFIR Foundations domain, which makes up ~8% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–10 in this domain), expect 6–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 16–20

16foundation · easy
Which type of cloud evidence source provides information about user actions, API calls, and system events, and is often essential for reconstructing an incident timeline?
Select an answer first
17application · medium
A forensic investigator is examining a serverless function in a PaaS environment. The function processed sensitive data and has already been invoked multiple times. Which evidence source is most likely to provide historical execution details?
Select an answer first
18expert · hard
A company uses a SaaS collaboration tool. An employee's account is compromised, and the attacker accessed sensitive files. The company needs to preserve evidence for a potential lawsuit. The provider offers eDiscovery export but only for the last 30 days. The incident occurred 45 days ago. What is the best course of action?
Select an answer first
19application · medium
A multinational company stores customer data in a public cloud region in the EU. A US-based law enforcement agency requests access to the data for an investigation. Which factor is most important for the company to consider before responding?
Select an answer first
20foundation · easy
Which cloud deployment model allows an organization to keep sensitive workloads in a dedicated environment while using shared resources for less critical processing, and what is a key DFIR implication?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Introduction to Cloud DFIR GCFR Practice Questions (Page 4)

Questions 16–20

Which type of cloud evidence source provides information about user actions, API calls, and system events, and is often essential for reconstructing an incident timeline?

A forensic investigator is examining a serverless function in a PaaS environment. The function processed sensitive data and has already been invoked multiple times. Which evidence source is most likely to provide historical execution details?

A multinational company stores customer data in a public cloud region in the EU. A US-based law enforcement agency requests access to the data for an investigation. Which factor is most important for the company to consider before responding?

Which cloud deployment model allows an organization to keep sensitive workloads in a dedicated environment while using shared resources for less critical processing, and what is a key DFIR implication?

Keep studying — Cloud DFIR Foundations