GIAC Cloud Forensics Responder
Domain 5Objective 1
Understanding Microsoft Azure and Log Sources GCFR Practice Questions (Page 7)
Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)
42questions here
9free pages
8concepts
Questions 31–35
- 31
An administrator notices that a virtual machine was stopped and deallocated, but the administrator did not perform this action. The administrator needs to find out who did it and whether it was done through the Azure portal, CLI, or an API call. Which log should the administrator examine?
Select an answer first - 32
What type of operations does the Azure Activity Log primarily capture?
Select an answer first - 33
An organization is investigating a potential data exfiltration by an employee. The investigator needs to determine if the employee accessed a specific SharePoint site and downloaded files. Which Azure AD log would provide this information?
Select an answer first - 34
A security analyst needs to investigate a potential data exfiltration from an Azure Storage account. The analyst wants to see detailed logs of read and write operations on the blobs, including the source IP addresses. The storage account is currently configured only with the default Azure monitoring. What should the analyst configure to capture the required data?
Select an answer first - 35
An investigator is analyzing a breach that involved an Azure Web App. The investigator has resource logs from the Web App showing HTTP requests, and Activity Logs showing that the Web App's configuration was changed. The investigator needs to determine if the configuration change affected the application's behavior. Which approach is most appropriate?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.