What is the primary purpose of cloud forensics and incident response (DFIR) in a modern IT environment?

To identify, preserve, analyze, and present digital evidence from cloud environments to support incident response and legal proceedings

To replace traditional on-premises forensic tools with cloud-native tools exclusively

To prevent all security incidents from occurring in cloud environments

To transfer all forensic investigation responsibilities to the cloud service provider

A financial institution is considering a community cloud for sharing data with partner banks. They need to ensure that each partner's data is isolated and that forensic investigations can be conducted without exposing other partners' data. Which consideration is most important?

The cloud provider's multi-tenancy isolation and forensic data segregation capabilities

The community cloud's compliance with industry standards

The community cloud's lower cost compared to a private cloud

The ability to access the physical servers for forensic imaging

A company uses a SaaS email platform. During an incident, they need to preserve a user's mailbox content for legal hold. The provider offers an API to place a litigation hold, but the company's incident response team is unsure whether they can also collect the underlying server logs from the hypervisor. Which action aligns with the shared responsibility model?

Request a raw disk image of the mailbox database from the provider's storage backend.

Use the provider's litigation hold API and request available audit logs from the provider; do not attempt to access hypervisor logs.

Deploy a network sniffer in the provider's data center to capture mailbox traffic.

Access the hypervisor logs directly using the customer's cloud management console.

A global company stores data in a public cloud region in Asia. A European regulatory body requests access to the data for an investigation. The company must comply with GDPR. What is the primary legal consideration?

Whether the data is stored in a private cloud

Whether the cloud provider is certified under ISO 27001

Whether the company has a data processing agreement with the provider

Whether the data transfer from Asia to Europe is lawful under GDPR

GIAC Cloud Forensics Responder

Domain 1Objective 1

Introduction to Cloud DFIR GCFR Practice Questions (Page 6)

Part of the Cloud DFIR Foundations domain, which makes up ~8% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–10 in this domain), expect 6–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 26–30

26foundation · easy
Which legal or regulatory issue is particularly relevant when cloud data is stored in a different country than the investigating organization?
Select an answer first
27foundation · easy
What is the primary purpose of cloud forensics and incident response (DFIR) in a modern IT environment?
Select an answer first
28expert · hard
A financial institution is considering a community cloud for sharing data with partner banks. They need to ensure that each partner's data is isolated and that forensic investigations can be conducted without exposing other partners' data. Which consideration is most important?
Select an answer first
29application · medium
A company uses a SaaS email platform. During an incident, they need to preserve a user's mailbox content for legal hold. The provider offers an API to place a litigation hold, but the company's incident response team is unsure whether they can also collect the underlying server logs from the hypervisor. Which action aligns with the shared responsibility model?
Select an answer first
30expert · hard
A global company stores data in a public cloud region in Asia. A European regulatory body requests access to the data for an investigation. The company must comply with GDPR. What is the primary legal consideration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Introduction to Cloud DFIR GCFR Practice Questions (Page 6)

Questions 26–30

Which legal or regulatory issue is particularly relevant when cloud data is stored in a different country than the investigating organization?

What is the primary purpose of cloud forensics and incident response (DFIR) in a modern IT environment?

A financial institution is considering a community cloud for sharing data with partner banks. They need to ensure that each partner's data is isolated and that forensic investigations can be conducted without exposing other partners' data. Which consideration is most important?

A global company stores data in a public cloud region in Asia. A European regulatory body requests access to the data for an investigation. The company must comply with GDPR. What is the primary legal consideration?

Keep studying — Cloud DFIR Foundations