During an incident response, you need to preserve a storage container that contains evidence. The container is currently in the Archive access tier. You need to ensure the blobs are available for forensic analysis within 1 hour and that the original blobs are not modified. What should you do?

Download the blobs using AzCopy with the --rehydrate-priority=high flag

Use the Set Blob Tier operation on each blob to change to Cool tier

Change the access tier of the container to Hot and wait for the rehydration to complete

Copy the blobs to a new container in the Hot tier using the copy operation

A forensic investigator needs to collect storage logs from a storage account that has geo-redundant storage (GRS) enabled. The primary region is unavailable. Which endpoint should the investigator use to access the logs?

The secondary endpoint only if RA-GRS is enabled

The failover endpoint after initiating a manual failover

A company has an Azure VNet with multiple subnets. They need to ensure that only the subnet containing web servers can communicate with the subnet containing database servers. Which Azure resource should they use to enforce this?

Network security group (NSG) applied to the database subnet

GIAC Cloud Forensics Responder

Domain 5Objective 3

Microsoft Azure Storage and Networking GCFR Practice Questions (Page 4)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

14concepts

14 Concepts in This Objective

Azure Storage Account Types
Azure Blob Storage Access Tiers
Azure Storage Redundancy Options
Azure Storage Security Features
Azure Storage Logging and Monitoring
Azure Virtual Network (VNet) Fundamentals
Azure Network Security Groups (NSGs)
Azure Firewall and DDoS Protection
Azure Load Balancer and Application Gateway
Azure VPN Gateway and ExpressRoute
Azure DNS and Traffic Manager
Azure Network Watcher
Azure Storage and Network Forensics Data Sources
Azure Storage and Network Incident Response Procedures

Questions 16–20

16application · medium
During an incident response, you need to preserve a storage container that contains evidence. The container is currently in the Archive access tier. You need to ensure the blobs are available for forensic analysis within 1 hour and that the original blobs are not modified. What should you do?
Select an answer first
17foundation · easy
Which of the following is a data source for forensic investigation in Azure Networking?
Select an answer first
18application · medium
A forensic investigator needs to collect storage logs from a storage account that has geo-redundant storage (GRS) enabled. The primary region is unavailable. Which endpoint should the investigator use to access the logs?
Select an answer first
19foundation · easy
An organization has a large dataset of archived forensic images that are rarely accessed but must be retained for compliance. Which Azure Blob Storage access tier is most cost-effective for this data while still allowing retrieval when needed?
Select an answer first
20application · medium
A company has an Azure VNet with multiple subnets. They need to ensure that only the subnet containing web servers can communicate with the subnet containing database servers. Which Azure resource should they use to enforce this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Microsoft Azure Storage and Networking GCFR Practice Questions (Page 4)

Questions 16–20

During an incident response, you need to preserve a storage container that contains evidence. The container is currently in the Archive access tier. You need to ensure the blobs are available for forensic analysis within 1 hour and that the original blobs are not modified. What should you do?

Which of the following is a data source for forensic investigation in Azure Networking?

A forensic investigator needs to collect storage logs from a storage account that has geo-redundant storage (GRS) enabled. The primary region is unavailable. Which endpoint should the investigator use to access the logs?

An organization has a large dataset of archived forensic images that are rarely accessed but must be retained for compliance. Which Azure Blob Storage access tier is most cost-effective for this data while still allowing retrieval when needed?

A company has an Azure VNet with multiple subnets. They need to ensure that only the subnet containing web servers can communicate with the subnet containing database servers. Which Azure resource should they use to enforce this?

Keep studying — Microsoft Azure Forensics