GIAC Cloud Forensics Responder
Domain 5Objective 4
Microsoft Unified Audit Log and Graph API GCFR Practice Questions (Page 8)
Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)
41questions here
9free pages
9concepts
Questions 36–40
- 36
A security analyst is writing a script to programmatically pull audit logs from Microsoft 365 using the Graph API. The script runs as a background service on a server and must not require user interaction. Which OAuth 2.0 grant flow and permission type should the analyst use?
Select an answer first - 37
A company needs to export Unified Audit Log records to an external SIEM for long-term storage and analysis. The company wants to automate this export on a daily basis. Which approach should the administrator use?
Select an answer first - 38
In the Microsoft Purview compliance portal, which page is used to search the Unified Audit Log?
Select an answer first - 39
A security team is setting up a service principal to access audit logs via the Graph API. They have assigned the 'AuditLog.Read.All' application permission to the service principal. However, when the service principal attempts to authenticate, it receives an 'invalid_client' error. What is the most likely cause?
Select an answer first - 40
In a Unified Audit Log record, which field identifies the user who performed the action?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.