Your security team needs to ensure that exported logs cannot be altered or deleted by an attacker who compromises a Cloud Storage bucket. You need a storage solution that provides write-once, read-many (WORM) protection. Which configuration should you use?

Set the bucket's IAM policy to only allow the security team to write

Enable object versioning on the bucket

Configure a retention policy with a retention period on the bucket

Use a Pub/Sub subscription to archive logs to Cloud Storage

Your organization has a compliance requirement to retain audit logs for 5 years. You have configured a log sink to export logs to a Cloud Storage bucket. However, you discover that logs are being deleted after 30 days. What is the most likely cause?

The log sink is not configured to export all log types

The log sink is using a Pub/Sub destination that expires after 30 days

Cloud Logging automatically deletes exported logs after 30 days

The Cloud Storage bucket has a lifecycle rule that deletes objects after 30 days

Your compliance team requires that exported logs be immutable and tamper-evident. You have decided to use Cloud Storage. Which feature should you enable to prevent modification and deletion of log objects?

Retention policy with a retention period

Bucket-level IAM policy with viewer role for all users

GIAC Cloud Forensics Responder

Domain 2Objective 4

Log Sources for Google Cloud IR GCFR Practice Questions (Page 5)

Part of the Google Cloud Platform Forensics domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

Questions 21–25

21application · medium
Your security team needs to ensure that exported logs cannot be altered or deleted by an attacker who compromises a Cloud Storage bucket. You need a storage solution that provides write-once, read-many (WORM) protection. Which configuration should you use?
Select an answer first
22expert · hard
Your organization has a compliance requirement to retain audit logs for 5 years. You have configured a log sink to export logs to a Cloud Storage bucket. However, you discover that logs are being deleted after 30 days. What is the most likely cause?
Select an answer first
23foundation · easy
You are investigating a security incident and need to search across logs from Compute Engine, Cloud Storage, and Cloud IAM in one place. Which GCP service provides this unified log search capability?
Select an answer first
24application · medium
Your compliance team requires that exported logs be immutable and tamper-evident. You have decided to use Cloud Storage. Which feature should you enable to prevent modification and deletion of log objects?
Select an answer first
25application · medium
Your organization wants to stream real-time Cloud Logging entries to an external SIEM for immediate alerting. You need to configure a log sink that delivers logs with minimal latency. Which destination should you choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Log Sources for Google Cloud IR GCFR Practice Questions (Page 5)

Questions 21–25

Your security team needs to ensure that exported logs cannot be altered or deleted by an attacker who compromises a Cloud Storage bucket. You need a storage solution that provides write-once, read-many (WORM) protection. Which configuration should you use?

Your organization has a compliance requirement to retain audit logs for 5 years. You have configured a log sink to export logs to a Cloud Storage bucket. However, you discover that logs are being deleted after 30 days. What is the most likely cause?

You are investigating a security incident and need to search across logs from Compute Engine, Cloud Storage, and Cloud IAM in one place. Which GCP service provides this unified log search capability?

Your compliance team requires that exported logs be immutable and tamper-evident. You have decided to use Cloud Storage. Which feature should you enable to prevent modification and deletion of log objects?

Your organization wants to stream real-time Cloud Logging entries to an external SIEM for immediate alerting. You need to configure a log sink that delivers logs with minimal latency. Which destination should you choose?

Keep studying — Google Cloud Platform Forensics