A company is preparing for a potential legal investigation that may require access to Azure Activity Logs from six months ago. The company currently has no diagnostic settings configured for the subscription. What should the administrator do to ensure the historical Activity Log data is available for the investigation?

Configure a diagnostic setting to export the Activity Log to a Log Analytics workspace or storage account

Create a new resource group and move the subscription into it

Rely on the default 90-day retention of the Activity Log in the Azure portal

Enable Azure AD sign-in logs for the subscription

A forensic investigator is examining an Azure SQL database that was accessed by an attacker. The investigator needs to determine which queries were executed against the database. Which log source should they enable?

SQL server resource logs (diagnostic logs)

GIAC Cloud Forensics Responder

Domain 5Objective 1

Understanding Microsoft Azure and Log Sources GCFR Practice Questions (Page 4)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 16–20

16foundation · easy
Which field is typically included in an Azure Activity Log entry and is critical for forensic attribution?
Select an answer first
17foundation · easy
Which type of log is generated by an Azure resource's internal operations, such as requests to a database or application logs from a web server?
Select an answer first
18application · medium
A company is preparing for a potential legal investigation that may require access to Azure Activity Logs from six months ago. The company currently has no diagnostic settings configured for the subscription. What should the administrator do to ensure the historical Activity Log data is available for the investigation?
Select an answer first
19foundation · easy
Which Azure log source is used to capture data-plane operations and performance data from within a specific resource, such as a virtual machine or a database?
Select an answer first
20application · medium
A forensic investigator is examining an Azure SQL database that was accessed by an attacker. The investigator needs to determine which queries were executed against the database. Which log source should they enable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Understanding Microsoft Azure and Log Sources GCFR Practice Questions (Page 4)

Questions 16–20

Which field is typically included in an Azure Activity Log entry and is critical for forensic attribution?

Which type of log is generated by an Azure resource's internal operations, such as requests to a database or application logs from a web server?

Which Azure log source is used to capture data-plane operations and performance data from within a specific resource, such as a virtual machine or a database?

A forensic investigator is examining an Azure SQL database that was accessed by an attacker. The investigator needs to determine which queries were executed against the database. Which log source should they enable?

Keep studying — Microsoft Azure Forensics