An organization uses a PaaS database service with automated backups. During an incident, they need to recover a database to a specific point in time to analyze the attack. The database is in a multi-tenant environment. Which approach is most likely to provide the needed forensic evidence?

Request the provider's raw storage volume from the underlying multi-tenant cluster.

Use the provider's backup file to restore directly to the production instance without isolating it.

Take a memory dump of the database server from the provider's hypervisor.

Restore the database to a separate instance using a point-in-time recovery and enable detailed query logs.

Your company uses a PaaS service to run a custom application. The application is suspected of being compromised. Which evidence source is most likely to be available to you as the customer?

Network packet captures from the physical network

Hypervisor memory dumps of the underlying host

Raw disk images of the virtual machines

Application-level logs and configuration settings

An organization uses a PaaS service to host a custom application. A security incident occurs, and the IR team needs to collect forensic evidence. The team has access to application logs but not to the underlying VMs. Which evidence source is most appropriate for the team to collect?

Raw disk images of the underlying VMs

Network packet captures from the physical network

Application-level logs and configuration settings

GIAC Cloud Forensics Responder

Domain 1Objective 1

Introduction to Cloud DFIR GCFR Practice Questions (Page 7)

Part of the Cloud DFIR Foundations domain, which makes up ~8% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–10 in this domain), expect 6–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 31–35

31expert · hard
An organization uses a PaaS database service with automated backups. During an incident, they need to recover a database to a specific point in time to analyze the attack. The database is in a multi-tenant environment. Which approach is most likely to provide the needed forensic evidence?
Select an answer first
32application · medium
An incident response team is investigating a breach in a hybrid cloud environment. They need a structured approach that includes identifying evidence sources, preserving data, and documenting the investigation for potential legal review. Which framework is most appropriate to guide their work?
Select an answer first
33application · medium
Your company uses a PaaS service to run a custom application. The application is suspected of being compromised. Which evidence source is most likely to be available to you as the customer?
Select an answer first
34expert · hard
An organization uses a PaaS service to host a custom application. A security incident occurs, and the IR team needs to collect forensic evidence. The team has access to application logs but not to the underlying VMs. Which evidence source is most appropriate for the team to collect?
Select an answer first
35foundation · easy
In the cloud incident response process, which step involves actions to stop the incident from spreading and to isolate affected systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Introduction to Cloud DFIR GCFR Practice Questions (Page 7)

Questions 31–35

An organization uses a PaaS database service with automated backups. During an incident, they need to recover a database to a specific point in time to analyze the attack. The database is in a multi-tenant environment. Which approach is most likely to provide the needed forensic evidence?

An incident response team is investigating a breach in a hybrid cloud environment. They need a structured approach that includes identifying evidence sources, preserving data, and documenting the investigation for potential legal review. Which framework is most appropriate to guide their work?

Your company uses a PaaS service to run a custom application. The application is suspected of being compromised. Which evidence source is most likely to be available to you as the customer?

An organization uses a PaaS service to host a custom application. A security incident occurs, and the IR team needs to collect forensic evidence. The team has access to application logs but not to the underlying VMs. Which evidence source is most appropriate for the team to collect?

In the cloud incident response process, which step involves actions to stop the incident from spreading and to isolate affected systems?

Keep studying — Cloud DFIR Foundations