GIAC Cloud Forensics Responder
Domain 5Objective 3
Microsoft Azure Storage and Networking GCFR Practice Questions (Page 3)
Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)
47questions here
10free pages
14concepts
Questions 11–15
- 11
A forensic investigator is analyzing NSG flow logs to determine if a compromised VM communicated with a known command-and-control server. The flow logs show that the VM sent traffic to the C2 IP address, but the logs do not show the destination port. What is the most likely reason for this missing information?
Select an answer first - 12
Which of the following is a data source for forensic investigation in Azure Storage?
Select an answer first - 13
Which Azure Storage security feature encrypts data at rest by default using Microsoft-managed keys, and can also be configured with customer-managed keys?
Select an answer first - 14
During an incident, you need to capture network traffic from a VM that is not in a VNet with Network Watcher enabled. What is the first step?
Select an answer first - 15
A forensic team needs to collect evidence from a storage account that is configured with LRS. The primary region is experiencing an outage. What is the best course of action?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.