Month End Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

GIAC GCFR GIAC Cloud Forensics Responder (GCFR) Exam Practice Test

Demo: 22 questions
Total 82 questions

GIAC Cloud Forensics Responder (GCFR) Questions and Answers

Question 1

What is the maximum file size for Azure Page Blob storage?

Options:

A.

10.25 TB

B.

10.25 TB

C.

8TB

D.

7TB

Question 2

A system administration team has deployed several laaS platform servers and intend to host a custom application in the cloud. Which of the following is the responsibility of the system administration team with this architecture?

Options:

A.

Transferring the private key* for encrypting application data to the cloud provider

B.

Creating a redundant data center to provide global backups

C.

Fixing software vulnerabilities in the code on the perimeter firewall

D.

System security patches and updates for the application servers

Question 3

The Azure PowerShell output below is an example of which of the following?

Options:

A.

Role assignment

B.

Managed identity

C.

Role definition

D.

Service principal

Question 4

Which cloud model should an organization negotiate access to logs as pert of contract negotiation prior to using the service?

Options:

A.

IaaS

B.

PaaS

C.

Saas

Question 5

A client was responsible for their environment's OS, then they delegated this responsibility to their cloud provider. Which of the following migrations could describe this scenario?

Options:

A.

On-prern to UdS

B.

SaaStoOn-prem

C.

IaaS to PaaS

D.

PaaS to SaaS

Question 6

A company is creating an incident response team that will be part of their existing GCP Organization. Where in the organizational structure should their services be placed?

Options:

A.

With the Resources

B.

As part of d Project

C.

ln a dedicated Folder

D.

At the root Organization

Question 7

Which statement describes how an organization could use IPv6 in a Google Cloud deployment?

Options:

A.

IPv6 has to be configured for each compute node Individually

B.

IPv6 b enabled by default for global traffic between VPCs

C.

IPv6 is enabled by default for traffic within VPCs

D.

IPv6 needs to be terminated at an edge load balancer

Question 8

At which level of an Azure cloud deployment are resource management logs generated?

Options:

A.

Management Group

B.

Resource Group

C.

Tenant

D.

Subscription

Question 9

Below is an extract from a Server Access Log showing arecord for a request made to an AWS S3 bucket. What does the first field starting with "385f9e" represent?

Options:

A.

Bucket Owner

B.

Request ID

C.

Host ID

D.

Cipher Suite

Question 10

Use Kibana to analyze the Azure AD sign-in logs in the azure-* index. On March 31st, 2021, what is the timestamp of the earliest failed login attempt for the accountdcr0ss5pymtechlabs.com?

ViewVM

Options:

A.

19:21:34

B.

18:11:07

C.

19:01:27

D.

01:04:24

E.

18:12:04

F.

19:02:06

G.

01:02:56

Question 11

An engineer is looking for the log of API calls recorded by CloudTrail for the past 6 months. Where should they look for the oldest data?

Options:

A.

Lambda ephemeral storage

B.

S3 bucket

C.

requestParameters

Question 12

AWS VPC Flow logs are enabled. What do these logs capture?

Options:

A.

TCP Checksums

B.

Packet Metadata

C.

TLS Handshakes

D.

Payload Bytes

Question 13

What can bedetermine about the AVVS Access Key below?

AKIAVNKBKCM4I3VNZIS3

Options:

A.

The key belongs to a user account

B.

The key will only work internally

C.

It is a service STS token

D.

It is only in use for a single session

Question 14

What is the lowest level of GCP organization that consists of a logical grouping of services?

Options:

A.

Project

B.

Folder

C.

Organization

D.

Unit

Question 15

The attack technique "Access Kubelet API" falls under which Mitre ATT&CK tactic?

Options:

A.

Execution

B.

Credential Access

C.

Discovery

D.

Initial Access

Question 16

A company using PaaS to host and develop their software application is experiencing a DOS attack. What challenge will a DFIR analyst experience when investigating this attack?

Options:

A.

Restricted access to their application logs

B.

Resource scaling will affect access to logs

C.

Network logs are unavailable for review

D.

Network monitoring disabled by the company

Question 17

What approach can be used to enable Mac instances on AWS?

Options:

A.

Emulating the M1 processor using ARM clusters

B.

Installing OS X exclusively on I (Burstable) instance

C.

Using physical Mac computers in the data center

D.

Virtualizing OS X on Unix servers

Question 18

What method does Google use to alert Gmail account holders that they may be under attack by government sponsored attackers?

Options:

A.

Message upon successful logon

B.

SMS text message

C.

Email sent to the user

D.

Alert sent to recovery account

Question 19

An investigator confirms that phishing emails sent to users in an organization ate not being sent to their Gmall Spam folder. What is a possible cause for this?

Options:

A.

The default setting for enhanced pre-delivery message scanning was changed

B.

The security sandbox default configuration setting was changed

C.

A third party application needs to be installed to detect phishing emails

D.

Compliance based rules need to be configured to detect phishing emails

Question 20

An investigator is evaluating a client's Microsoft 365 deployment using the web portals and has identified that the Purview compliance portal states that the Unified Audit Logs are not enabled. Based on the additional Information gathered below, what is most likely the cause of this configuration message?

Subscription creation date: December 4, 2021 Number of administrators: 2 Number of non-administrative user accounts: 74 Last tenant administration change: December 4,2021

Options:

A.

Explicitly been disabled by an administrator

B.

License was downgraded lower than an E5 license

C.

Tenant is configured to forward logs externally

D.

Default configuration, service was never enabled

Question 21

An analyst investigating a malicious application determines that it runs using AVVS Lambda. What challenge will the analyst likely encounter during the Investigation?

Options:

A.

Application Is no longer active

B.

Hardware raps are misconfigured

C.

Large amounts of log data

D.

Server is poorly managed

Question 22

Which is a limitation when adding GPUs to Google cloud VMs?

Options:

A.

They can only be added at VM creation

B.

Preemptible VMs do not support GPU addition

C.

Google limits the GPUs assigned to a single VM

D.

They are only available in specific zones

Demo: 22 questions
Total 82 questions