GCFR Exam Training Practice Tests (GIAC Cloud Forensics Responder (GCFR))]

Question 1

Which is the effective access when aws user is assigned to an S3 bucket?

A. A user must have an account under any AWS account B. A user must have an employee account C. A user must be under the same AWS account as the S3 bucket D. A user must have the AWS IAM role assigned

Correct Answer: C

Question 2

An investigator confirms that phishing emails sent to users in an organization ate not being sent to their Gmall Spam folder. What is a possible cause for this?

A. The security sandbox default configuration setting was changed B. Compliance based rules need to be configured to detect phishing emails C. The default setting for enhanced pre-delivery message scanning was changed D. A third party application needs to be installed to detect phishing emails

Correct Answer: C

Question 3

Which of the following Windows agents would need to be configured on an Azure VM for an investigator to query Its operating system logs sent to Azure Storage?

A. Diagnostic Extension B. Log Analytics C. Azure Monitor D. Dependency

Correct Answer: A

Question 4

Which Azure blob storage option is typically used to store virtual hard drive (VHD) Ales?

A. File B. Block C. Append D. page

Correct Answer: D

Question 5

The Azure PowerShell output below is an example of which of the following?

A. Role definition B. Service principal C. Managed identity D. Role assignment

Correct Answer: C

Question 6

Which AW5 1AM policy element indicates the API that is in scope?

A. Action B. Effect C. Version D. Resource

Correct Answer: A

Question 7

What unique identifier is used by AWS to identify a specific account and allow integration with external organizations?

A. ARN B. SID C. Public Key D. Token

Correct Answer: A

Question 8

What can be inferred about the ARN below?
arn:aws:!am::457787814323:user/giac

A. giac's user's access key 10 is 457787814323 B. giac's Is limited to roles defined under a single AWS organization C. giac's is a user In the AWS account 457787814323 D. giac's access Is testf kted to resources owned by AWS tenant 457787814323

Correct Answer: C

Question 9

What is the expected time delay for Azure AD logs to become searchable in the Microsoft 365 Unified Audit Log?

A. 5 to 15 minutes B. Up to 6 hours C. Up to 24 hours D. 24 to 48 hours

Correct Answer: C

GIAC Cloud Forensics Responder (GCFR) - GCFR Exam Practice Test