A small business uses a cloud-based customer relationship management (CRM) system. They suspect an insider exfiltrated customer data. Which forensic approach is most appropriate for this SaaS environment?

Use the CRM's built-in audit logs and export the user's activity history.

Ask the provider for a full disk image of the CRM database server.

Perform a network packet capture on the company's internet connection to see all CRM traffic.

Request a memory dump of the CRM server from the provider.

During the containment phase of a cloud incident, the responder must preserve evidence while stopping the attacker's access. Which action is most effective for both goals?

Delete the compromised VM immediately to prevent further damage.

Revoke the compromised credentials and enable network security group rules to block the attacker's IP, while taking a snapshot of the affected VM.

Disconnect the VM from the network without taking any forensic copies.

Change the VM's password and continue monitoring without isolating the network.

What is the primary purpose of eDiscovery in the context of cloud DFIR?

To permanently delete all data from cloud storage

To monitor cloud performance metrics

To identify, preserve, and produce electronically stored information (ESI) for legal proceedings

To encrypt all cloud data at rest

Which of the following is a potential source of forensic evidence in a cloud environment?

Cloud provider's physical hard drives

GIAC Cloud Forensics Responder

Domain 1Objective 1

Introduction to Cloud DFIR GCFR Practice Questions (Page 8)

Part of the Cloud DFIR Foundations domain, which makes up ~8% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–10 in this domain), expect 6–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 36–40

36foundation · easy
Which cloud deployment model is characterized by infrastructure that is shared by multiple organizations with similar interests or compliance requirements, often operated by a third party?
Select an answer first
37application · medium
A small business uses a cloud-based customer relationship management (CRM) system. They suspect an insider exfiltrated customer data. Which forensic approach is most appropriate for this SaaS environment?
Select an answer first
38application · medium
During the containment phase of a cloud incident, the responder must preserve evidence while stopping the attacker's access. Which action is most effective for both goals?
Select an answer first
39foundation · easy
What is the primary purpose of eDiscovery in the context of cloud DFIR?
Select an answer first
40foundation · easy
Which of the following is a potential source of forensic evidence in a cloud environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.