A developer is building a custom dashboard to display audit log data. The developer wants to use the Microsoft Graph API to retrieve the data. Which authentication method should the developer use to obtain an access token for the Graph API?

OAuth 2.0 authorization code flow

OAuth 2.0 resource owner password credentials flow

OAuth 2.0 client credentials flow

A forensic investigator is using the Graph API to query audit logs. The investigator has been granted the 'AuditLog.Read.All' application permission. However, when making a request to /auditLogs/activities, the response returns a 403 Forbidden error. What is the most likely cause?

The application does not have the required permission granted by an admin

The request is missing the $filter parameter

The request is using the wrong HTTP method

The application is using the beta endpoint

An analyst is reviewing a Unified Audit Log entry for a user who is suspected of sharing a confidential document externally. The audit record shows the operation 'SharingSet' and the 'UserId' is the user's account. However, the analyst needs to confirm the document was shared externally. Which additional field in the audit record should the analyst examine?

The 'Target' or 'Item' field to see the URL or file name of the shared document

The 'ClientIP' field to see the IP address of the user

The 'Operation' field to see if it is 'SharingSet' or 'SharingUpdated'

The 'RecordType' field to see if it is SharePoint or OneDrive

What is the benefit of correlating Unified Audit Log data with Azure AD sign-in logs during a forensic investigation?

It automatically identifies the attacker in all cases

It provides real-time alerts for all suspicious activities

It eliminates the need for any other log sources

It helps establish a timeline of user actions and their authentication context

During an investigation, an analyst finds a Unified Audit Log entry showing that a user downloaded a sensitive file from SharePoint. The analyst wants to corroborate this activity with the user's sign-in details. Which additional data source should the analyst query to correlate the download with a successful sign-in?

Microsoft Defender for Cloud alerts

Azure Resource Manager template deployment history

Azure AD sign-in logs via the Microsoft Graph API

Azure Activity Log for the SharePoint site

GIAC Cloud Forensics Responder

Domain 5Objective 4

Microsoft Unified Audit Log and Graph API GCFR Practice Questions (Page 2)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

9concepts

Questions 6–10

6application · medium
A developer is building a custom dashboard to display audit log data. The developer wants to use the Microsoft Graph API to retrieve the data. Which authentication method should the developer use to obtain an access token for the Graph API?
Select an answer first
7expert · hard
A forensic investigator is using the Graph API to query audit logs. The investigator has been granted the 'AuditLog.Read.All' application permission. However, when making a request to /auditLogs/activities, the response returns a 403 Forbidden error. What is the most likely cause?
Select an answer first
8expert · hard
An analyst is reviewing a Unified Audit Log entry for a user who is suspected of sharing a confidential document externally. The audit record shows the operation 'SharingSet' and the 'UserId' is the user's account. However, the analyst needs to confirm the document was shared externally. Which additional field in the audit record should the analyst examine?
Select an answer first
9foundation · easy
What is the benefit of correlating Unified Audit Log data with Azure AD sign-in logs during a forensic investigation?
Select an answer first
10application · medium
During an investigation, an analyst finds a Unified Audit Log entry showing that a user downloaded a sensitive file from SharePoint. The analyst wants to corroborate this activity with the user's sign-in details. Which additional data source should the analyst query to correlate the download with a successful sign-in?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Microsoft Unified Audit Log and Graph API GCFR Practice Questions (Page 2)

Questions 6–10

A developer is building a custom dashboard to display audit log data. The developer wants to use the Microsoft Graph API to retrieve the data. Which authentication method should the developer use to obtain an access token for the Graph API?

A forensic investigator is using the Graph API to query audit logs. The investigator has been granted the 'AuditLog.Read.All' application permission. However, when making a request to /auditLogs/activities, the response returns a 403 Forbidden error. What is the most likely cause?

What is the benefit of correlating Unified Audit Log data with Azure AD sign-in logs during a forensic investigation?

Keep studying — Microsoft Azure Forensics