GIAC Cloud Forensics Responder
Domain 5Objective 1
Understanding Microsoft Azure and Log Sources GCFR Practice Questions (Page 5)
Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)
42questions here
9free pages
8concepts
Questions 21–25
- 21
Which Azure AD log type is most useful for determining if a user's account was modified, such as a password change or role assignment?
Select an answer first - 22
An organization has multiple Azure subscriptions for different business units. During an investigation, the investigator finds that a resource was deleted in subscription A, but the user who performed the deletion is from subscription B. The investigator needs to understand the scope of the user's permissions. Which Azure resource would provide this information?
Select an answer first - 23
Which Azure service is commonly used to export logs for long-term retention and advanced querying in a forensic investigation?
Select an answer first - 24
An investigator is analyzing a suspicious deletion of a storage account. The Activity Log shows the delete operation was performed by a service principal named 'backup-svc'. However, the investigator suspects that the service principal's credentials were compromised. Which additional evidence would BEST confirm this suspicion?
Select an answer first - 25
An investigator is reconstructing a timeline of a security incident. The investigator has Azure Activity Logs showing that a VM was created at 10:00 UTC, and Azure AD sign-in logs showing that a user authenticated at 09:55 UTC. The investigator also has resource logs from the VM showing data downloads at 10:10 UTC. What is the most effective way to correlate these events?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.