A company is moving its infrastructure to the cloud and wants to ensure that its incident response team can effectively investigate future security incidents. What is the most important preparation step?

Establish relationships with the cloud provider's support and legal teams.

Migrate all workloads to a single cloud provider.

Purchase additional cloud capacity for forensic analysis.

Disable all logging to reduce storage costs.

Which statement accurately describes the shared responsibility model as it applies to cloud forensics?

The provider and customer share equal responsibility for all forensic activities

The customer is responsible for forensic evidence collection in all layers, including physical infrastructure

Forensic responsibilities are divided based on which layers of the stack each party controls

The provider is responsible for all forensic evidence collection in every service model

Why does multi-tenancy create a forensic challenge in cloud environments?

It can cause evidence from one tenant to be commingled with or obscured by data from other tenants

It prevents the cloud provider from logging any activities

It allows investigators to access all tenants' data without restrictions

It guarantees that forensic evidence is always preserved for all tenants

Which cloud service model typically provides the LEAST direct access to underlying infrastructure logs and system-level forensic data?

Infrastructure as a Service (IaaS)

A multinational company stores customer data in a public cloud region in the EU. A forensic investigation requires collecting logs that may contain personal data. The legal team is concerned about GDPR compliance. What is the most important consideration?

Use a private cloud to avoid GDPR obligations.

Delete all personal data from the logs before collection.

Ensure the data remains within the EU region during collection and analysis.

Obtain a warrant from the local law enforcement agency.

GIAC Cloud Forensics Responder

Domain 1Objective 1

Introduction to Cloud DFIR GCFR Practice Questions (Page 5)

Part of the Cloud DFIR Foundations domain, which makes up ~8% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–10 in this domain), expect 6–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 21–25

21application · medium
A company is moving its infrastructure to the cloud and wants to ensure that its incident response team can effectively investigate future security incidents. What is the most important preparation step?
Select an answer first
22foundation · easy
Which statement accurately describes the shared responsibility model as it applies to cloud forensics?
Select an answer first
23foundation · easy
Why does multi-tenancy create a forensic challenge in cloud environments?
Select an answer first
24foundation · easy
Which cloud service model typically provides the LEAST direct access to underlying infrastructure logs and system-level forensic data?
Select an answer first
25application · medium
A multinational company stores customer data in a public cloud region in the EU. A forensic investigation requires collecting logs that may contain personal data. The legal team is concerned about GDPR compliance. What is the most important consideration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.