A security engineer is building a tool to automatically detect suspicious activity by querying Cloud Logging. The tool needs to retrieve logs from multiple projects and aggregate them. Which approach is most efficient and scalable?

Use gcloud logging read with a project flag for each project.

Create a log sink that exports logs from all projects to a central BigQuery dataset and query BigQuery.

Use the Cloud Logging API entries.list method for each project separately and merge results in the application.

Use the Cloud Logging API to read logs from the organization level.

An analyst is investigating a compromised Compute Engine instance. The analyst wants to see all logs related to that instance, including system logs and audit logs. In the Logs Explorer, which filter would be most effective?

logName="projects/myproject/logs/cloudaudit.googleapis.com%2Factivity"

resource.type="gce_instance" AND resource.labels.instance_id="123456"

resource.labels.zone="us-central1-a"

GIAC Cloud Forensics Responder

Domain 2Objective 4

Log Sources for Google Cloud IR GCFR Practice Questions (Page 4)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

Questions 16–20

16expert · hard
A security engineer is building a tool to automatically detect suspicious activity by querying Cloud Logging. The tool needs to retrieve logs from multiple projects and aggregate them. Which approach is most efficient and scalable?
Select an answer first
17foundation · easy
What is the default retention period for logs stored in Cloud Logging?
Select an answer first
18application · medium
An analyst is investigating a compromised Compute Engine instance. The analyst wants to see all logs related to that instance, including system logs and audit logs. In the Logs Explorer, which filter would be most effective?
Select an answer first
19foundation · easy
You need to export logs to Cloud Storage for long-term retention. Which destination type can be used in a log sink?
Select an answer first
20foundation · easy
What is the name of the Cloud Logging feature that allows you to route log entries to destinations like BigQuery, Pub/Sub, or Cloud Storage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Log Sources for Google Cloud IR GCFR Practice Questions (Page 4)

Questions 16–20

A security engineer is building a tool to automatically detect suspicious activity by querying Cloud Logging. The tool needs to retrieve logs from multiple projects and aggregate them. Which approach is most efficient and scalable?

What is the default retention period for logs stored in Cloud Logging?

An analyst is investigating a compromised Compute Engine instance. The analyst wants to see all logs related to that instance, including system logs and audit logs. In the Logs Explorer, which filter would be most effective?

You need to export logs to Cloud Storage for long-term retention. Which destination type can be used in a log sink?

What is the name of the Cloud Logging feature that allows you to route log entries to destinations like BigQuery, Pub/Sub, or Cloud Storage?

Keep studying — Google Cloud Platform Forensics