Weekend Sale Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

GIAC GCFR GIAC Cloud Forensics Responder (GCFR) Exam Practice Test

Page: 1 / 8
Total 82 questions

GIAC Cloud Forensics Responder (GCFR) Questions and Answers

Question 1

What 1$ a drawback of analyzing a snapshot outside of AWS?

Options:

A.

Incomplete data

B.

Long download time

C.

Incompatible image format

D.

Low latency

Question 2

Which performance feature of an Amazon EC2 instance is configured to add additional resources based on set trigger points?

Options:

A.

Burstable

B.

Optimized

C.

Managed

D.

Accelerated

Question 3

Access Kibana via http://10.0.1.7:5601 and use the azure-* index pattern. Between March 31st, 2021 and April 3rd, 2021, how many virtual machines were created that use a Linux operating system?

Options:

A.

4

B.

6

C.

5

D.

2

E.

3

F.

8

G.

7

Question 4

What is the example AWS data below an example of?

Question # 4

Options:

A.

EC2 Configuration

B.

S3 Configuration

C.

Network Security Group

D.

IAM Policy

Question 5

What unique identifier is used by AWS to identify a specific account and allow integration with external organizations?

Options:

A.

Public Key

B.

Token

C.

ARN

D.

SID

Question 6

What AWS service will allow an organization to set custom compliance metrics and force compliance on an organizational, sub-organizational, or individual account level?

Options:

A.

Config

B.

Cognllo

C.

Inspector

D.

Security Hub

Question 7

Which is a limitation of AWS Lambdas?

Options:

A.

Functions must run in less than 15 minutes

B.

They can be quite costly to operate

C.

Managing systems can be time consuming

D.

They only support up to 256 MB of storage

Question 8

After registering the application in Azure AD, what is the next step to take in order to use Microsoft Graph API?

Options:

A.

Request access tokens from Azure An

B.

Call the Graph API

C.

Configure app permission

D.

Get Microsoft 365global admin approval

Question 9

What method does Google use to alert Gmail account holders that they may be under attack by government sponsored attackers?

Options:

A.

Message upon successful logon

B.

SMS text message

C.

Email sent to the user

D.

Alert sent to recovery account

Question 10

What can be inferred about the ARN below?

arn:aws:!am::457787814323:user/giac

Options:

A.

giac's is a user In the AWS account 457787814323

B.

giac's access Is testf kted to resources owned by AWS tenant 457787814323

C.

giac's Is limited to roles defined under a single AWS organization

D.

giac's user's access key 10 is 457787814323

Question 11

An engineer is troubleshooting a complaint that a web server in AWS cannot receive incoming traffic, but the server can connect to the internet otherwise. What is needed to solve this problem?

Options:

A.

VPC Subnet

B.

NAT Gateway

C.

Network Security Group

D.

Internet Gateway

Question 12

An investigator is evaluating a client's Microsoft 365 deployment using the web portals and has identified that the Purview compliance portal states that the Unified Audit Logs are not enabled. Based on the additional Information gathered below, what is most likely the cause of this configuration message?

Subscription creation date: December 4, 2021 Number of administrators: 2 Number of non-administrative user accounts: 74 Last tenant administration change: December 4,2021

Options:

A.

Explicitly been disabled by an administrator

B.

License was downgraded lower than an E5 license

C.

Tenant is configured to forward logs externally

D.

Default configuration, service was never enabled

Question 13

What would prevent GCP 1AM from linking to Google Workspace tomanageusers and groups?

Options:

A.

A gcp-organization-admins group was not created

B.

The connector was not configured to link the services

C.

Inadequate Identity and Access Management license

D.

Google Workspace cannot be linked to GCP 1AM

Question 14

Sensitive company data is found leaked on the internet, and the security team didn't

get any alert and is unsure of how the breach occurred.

Which logs would be a preferable starting point for an investigation?

Options:

A.

Identity and Access Management

B.

Application

C.

Resource Management

D.

Endpoint

Question 15

What is shown in the screenshot?

Question # 15

Options:

A.

Google threat types

B.

Windows event channels

C.

Mitre ATT&CK tactics

D.

CIS critical controls

Question 16

A cloud administrator needs to determine which user account allowed SSH Inbound from the internet on an Azure Network security group. Which type of log does the administrator need to examine?

Options:

A.

Tenant

B.

Subscription

C.

Operating System

D.

Resource

Question 17

Which Azure blob storage option is typically used to store virtual hard drive (VHD) Ales?

Options:

A.

page

B.

Append

C.

File

D.

Block

Question 18

What Pub/Sub component is used to forward GCP logs to their final location?

Options:

A.

Topic

B.

Log Sink

C.

Publication

D.

Subscription

Question 19

Which EBS volumetype would be appropriate to support a business critical SQL server hosted In AWS?

Options:

A.

ST1

B.

GP3

C.

GP2

D.

I01

Question 20

Which of the following actions described below would populate the suggestions table on an Android phone?

Options:

A.

Google Maps recommends locations, which are cached in the table

B.

Google Maps tracks previously entered destinations by the user

C.

The table contains previously saved or bookmarked destinations

Question 21

A company using PaaS to host and develop their software application is experiencing a DOS attack. What challenge will a DFIR analyst experience when investigating this attack?

Options:

A.

Restricted access to their application logs

B.

Resource scaling will affect access to logs

C.

Network logs are unavailable for review

D.

Network monitoring disabled by the company

Question 22

What is the expected time delay for Azure AD logs to become searchable in the Microsoft 365 Unified Audit Log?

Options:

A.

5 to 15 minutes

B.

Up to 6 hours

C.

Up to 24 hours

D.

24 to 48 hours

Question 23

Question # 23

Options:

A.

Permits remote creation of a Snapshot in a different region from the VM

B.

Allows use of classic acquisition tools directly on the Snapshot disk

C.

Allows direct access to the Snapshot VM disk

D.

Grants use of a one-time URL to download a Snapshot VHD

Question 24

Microsoft.Key Vault is an example of which component of Azure's structure?

Options:

A.

Resource manager

B.

Resource

C.

Resource provider

D.

Resource group

Page: 1 / 8
Total 82 questions