Log Sources for Google Cloud IR GCFR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During an incident, you need to programmatically retrieve all log entries from a specific Compute Engine instance over the last hour. You have the instance's resource labels. Which Cloud Logging API call should you use?

   • Aentries.list with a filter specifying the resource type and instance ID
   • Bentries.write with the instance's log entries
   • CmonitoredResourceDescriptors.list to find the instance
   • Dlogs.list to get a list of log names for the instance
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   During an incident response engagement in Google Cloud, you need to identify the primary log sources that provide visibility into user actions, resource changes, and system events. Which set of services represents the primary log sources for GCP incident response?

   • ACloud IAM, Cloud KMS, and Secret Manager
   • BCloud Storage, Cloud SQL, and Cloud Spanner
   • CCloud Monitoring, Cloud Trace, and Cloud Profiler
   • DCloud Logging, Cloud Audit Logs, and VPC Flow Logs
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   You need to find all log entries related to a specific Cloud Storage bucket in the Cloud Console. What is the most direct way to do this?

   • ANavigate to the Cloud Storage bucket and click on 'View logs'
   • BUse Cloud Monitoring to view logs for the bucket
   • CUse the Cloud Shell command 'gcloud logging read'
   • DUse the Logs Explorer and filter by resource type 'gcs_bucket' and the bucket name
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A forensic investigator is responding to an incident involving a compromised GKE cluster. Which GCP log source would provide the most direct evidence of actions performed by the Kubernetes control plane, such as creating a pod or modifying a deployment?

   • AVPC Flow Logs
   • BCloud DNS logs
   • CCloud Audit Logs
   • DCloud Monitoring metrics
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   During an incident, you need to determine whether a user accessed a specific object in a Cloud Storage bucket. You have enabled Data Access audit logs, but you cannot find the relevant log entry. Which of the following is the most likely reason?

   • AThe user accessed the object using the gsutil command
   • BData Access logs are disabled by default for Cloud Storage
   • CThe log entry is in the Admin Activity log instead
   • DThe log entry was deleted due to the 30-day retention
   Reveal Solution Discussion Select an answer first