GIAC Cloud Forensics Responder
Domain 5Objective 4
Microsoft Unified Audit Log and Graph API GCFR Practice Questions (Page 1)
Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)
41questions here
9free pages
9concepts
Questions 1–5
- 1
A forensic analyst needs to review all activities performed by a specific user in Exchange Online and SharePoint Online over the past 30 days. The analyst has been granted the necessary permissions in Microsoft Purview. Which approach should the analyst use to retrieve the required audit records?
Select an answer first - 2
An analyst is using Microsoft Graph to retrieve audit logs and wants to limit the response to only the fields needed for the investigation, such as activityDateTime, activityType, and initiatedBy. Which OData query parameter should the analyst use?
Select an answer first - 3
While reviewing a Unified Audit Log record, an analyst sees the field "Operation" set to "FileAccessed" and "RecordType" set to "6". The analyst needs to determine which user performed the action and when. Which two fields in the same record should the analyst examine?
Select an answer first - 4
Which Microsoft Graph API endpoint is used to retrieve audit log records for Azure AD activities?
Select an answer first - 5
An analyst is reviewing a Unified Audit Log entry and sees that the RecordType is "AzureActiveDirectory" and the Operation is "Add user.". The analyst wants to know which user was added and who performed the action. Which fields in the audit record should the analyst examine?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.