Why is cloud DFIR important in modern IT environments?

Because cloud environments are immune to security incidents

Because organizations increasingly rely on cloud services, which introduces new evidence sources, shared responsibilities, and investigation complexities

Because traditional on-premises forensic methods work identically in the cloud

Because cloud providers require customers to perform all forensic activities themselves

An incident responder needs to collect evidence from a serverless application that processes financial transactions. The application is deployed on a Function-as-a-Service platform. Which evidence source is most likely to contain the transaction details?

The platform's execution logs and application-level logging output

A memory dump of the function's container

A snapshot of the function's virtual disk

During a cloud incident, the response team discovers that the attacker has been using a compromised service account to access a storage bucket. The team needs to preserve evidence while stopping the attack. Which sequence of actions is most effective?

Disable the service account and rely on the provider's default logging.

Change the bucket permissions to private and continue monitoring.

Revoke the service account key, enable bucket versioning, and take a snapshot of the bucket metadata.

Delete the storage bucket immediately to prevent further access.

A forensic investigator is planning a cloud investigation that involves multiple jurisdictions and service providers. They need a methodology that addresses the shared responsibility model and provides a structured approach to evidence collection. Which framework is most suitable?

The NIST Cloud Computing Forensic Science Challenges and the CSA Cloud Forensic Framework

The DFIR Review Cloud Forensic Framework

The ISO/IEC 27037 standard alone

The SANS Investigative Forensic Toolkit (SIFT) methodology

GIAC Cloud Forensics Responder

Domain 1Objective 1

Introduction to Cloud DFIR GCFR Practice Questions (Page 9)

Part of the Cloud DFIR Foundations domain, which makes up ~8% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–10 in this domain), expect 6–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 41–45

41foundation · easy
Why is cloud DFIR important in modern IT environments?
Select an answer first
42expert · hard
An incident responder needs to collect evidence from a serverless application that processes financial transactions. The application is deployed on a Function-as-a-Service platform. Which evidence source is most likely to contain the transaction details?
Select an answer first
43expert · hard
During a cloud incident, the response team discovers that the attacker has been using a compromised service account to access a storage bucket. The team needs to preserve evidence while stopping the attack. Which sequence of actions is most effective?
Select an answer first
44expert · hard
A forensic investigator is planning a cloud investigation that involves multiple jurisdictions and service providers. They need a methodology that addresses the shared responsibility model and provides a structured approach to evidence collection. Which framework is most suitable?
Select an answer first
45application · medium
A government agency operates a cloud environment exclusively for its own use, hosted in a dedicated data center managed by a third party. The agency requires full control over forensic data collection. Which deployment model best describes this environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.