You need to write a script that retrieves all log entries from a specific project that contain a particular error message, and you want to use the Cloud Logging API. Which API method and filter would you use?

entries.list with filter: project="my-project" AND textPayload="ERROR: disk full"

monitoredResourceDescriptors.list with filter: project="my-project"

logs.list with filter: project="my-project" AND textPayload="ERROR: disk full"

entries.write with filter: project="my-project" AND textPayload="ERROR: disk full"

You need to retain logs for more than 30 days for a compliance requirement. Which option allows you to extend log retention beyond the default?

Use Cloud Monitoring to store logs

Increase the log retention period in Cloud Logging settings

Enable VPC Flow Logs for all resources

Export logs to Cloud Storage using a log sink

GIAC Cloud Forensics Responder

Domain 2Objective 4

Log Sources for Google Cloud IR GCFR Practice Questions (Page 3)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

Questions 11–15

11application · medium
You need to write a script that retrieves all log entries from a specific project that contain a particular error message, and you want to use the Cloud Logging API. Which API method and filter would you use?
Select an answer first
12foundation · easy
In a Cloud Logging log entry, which field identifies the specific GCP resource (such as a Compute Engine instance or Cloud Storage bucket) that generated the log?
Select an answer first
13foundation · easy
Which log type is specifically designed to record API calls that read or modify user-provided data, such as reading a Cloud Storage object or querying a BigQuery table?
Select an answer first
14foundation · easy
Which GCP service is the central hub for storing, searching, and analyzing logs from various GCP services, and is the primary tool for log-based incident response?
Select an answer first
15foundation · easy
You need to retain logs for more than 30 days for a compliance requirement. Which option allows you to extend log retention beyond the default?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Log Sources for Google Cloud IR GCFR Practice Questions (Page 3)

Questions 11–15

You need to write a script that retrieves all log entries from a specific project that contain a particular error message, and you want to use the Cloud Logging API. Which API method and filter would you use?

In a Cloud Logging log entry, which field identifies the specific GCP resource (such as a Compute Engine instance or Cloud Storage bucket) that generated the log?

Which log type is specifically designed to record API calls that read or modify user-provided data, such as reading a Cloud Storage object or querying a BigQuery table?

Which GCP service is the central hub for storing, searching, and analyzing logs from various GCP services, and is the primary tool for log-based incident response?

You need to retain logs for more than 30 days for a compliance requirement. Which option allows you to extend log retention beyond the default?

Keep studying — Google Cloud Platform Forensics