Halloween Special 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

GIAC GCFR Dumps

Page: 1 / 6
Total 82 questions

GIAC Cloud Forensics Responder (GCFR) Questions and Answers

Question 1

The Azure URI for the Develop VM is shown below. What will change in the notation when referencing the VM's OS disk?

Options:

A.

Resource Type

B.

Provider

C.

Resource Group

D.

Subscription ID

Buy Now
Question 2

A company using PaaS to host and develop their software application is experiencing a DOS attack. What challenge will a DFIR analyst experience when investigating this attack?

Options:

A.

Restricted access to their application logs

B.

Resource scaling will affect access to logs

C.

Network logs are unavailable for review

D.

Network monitoring disabled by the company

Question 3

Which is a limitation when adding GPUs to Google cloud VMs?

Options:

A.

They can only be added at VM creation

B.

Preemptible VMs do not support GPU addition

C.

Google limits the GPUs assigned to a single VM

D.

They are only available in specific zones

Question 4

Which AWS policy type specifies the maximum resource permissions for in organization or organizational unit (OU)?

Options:

A.

Resource

B.

Permission Boundaries

C.

Session

D.

Service Control

Question 5

An analyst successfully authenticated to Microsoft 365 using the following command. What would cause the analyst to be unable to search UAL events for a specific time period?

Ps> connect fxrhangeOnline userPrincipalName sysanalystatexanpteco.com

Options:

A.

The tmdlets to search the UAl were not Imported into the session

B.

The UAL cannot be searched when using Microsoft 365 PowerShell

C.

The incorrect version of the FxhangeOnlineManagement module was installed

D.

The ExchangeOnlineManagement module was not installed

Question 6

An investigator his successfully installed the ExchangeOnlineManagement module on their investigation system and is attempting to search a client's Microsoft 365 Unified Audit Log using PowerShell. PowerShell returns a "command not found" error each time they try to execute the Search-UnifiedAuditLog cmdlet. How should the investigator troubleshoot this issue?

Options:

A.

Ensure their system has .NFT version 4.b or later Installed

B.

Ensure that MFA has been disabled for The account used

C.

Check that they are using PowerShell Core

D.

Check the permissions of the account used in Microsoft 365

Question 7

Which AWS authentication method provides temporary, limited privilege credentials for 1AM users or federated users?

Options:

A.

lAMRole

B.

API Key

C.

SAML Token

Question 8

The attack technique "Access Kubelet API" falls under which Mitre ATT&CK tactic?

Options:

A.

Execution

B.

Credential Access

C.

Discovery

D.

Initial Access

Question 9

Microsoft.Key Vault is an example of which component of Azure's structure?

Options:

A.

Resource manager

B.

Resource

C.

Resource provider

D.

Resource group

Question 10

An investigator is evaluating a client's Microsoft 365 deployment using the web portals and has identified that the Purview compliance portal states that the Unified Audit Logs are not enabled. Based on the additional Information gathered below, what is most likely the cause of this configuration message?

Subscription creation date: December 4, 2021 Number of administrators: 2 Number of non-administrative user accounts: 74 Last tenant administration change: December 4,2021

Options:

A.

Explicitly been disabled by an administrator

B.

License was downgraded lower than an E5 license

C.

Tenant is configured to forward logs externally

D.

Default configuration, service was never enabled

Question 11

What is the example AWS data below an example of?

Options:

A.

EC2 Configuration

B.

S3 Configuration

C.

Network Security Group

D.

IAM Policy

Question 12

Access Kibana via and use the *ws-* index pattern. Use the time range 2021-03-0100:00 UTC to 2021 04 U 00:00 UTC. How many ec2 DescribMnstantp*; events were performed by the root user?

Options:

A.

374

B.

16

C.

6,695

D.

94

E.

0

F.

10

G.

2, 399

Question 13

Use Kibana to analyze the Azure AD sign-in logs in the azure-* index. On March 31st, 2021, what is the timestamp of the earliest failed login attempt for the accountdcr0ss5pymtechlabs.com?

ViewVM

Options:

A.

19:21:34

B.

18:11:07

C.

19:01:27

D.

01:04:24

E.

18:12:04

F.

19:02:06

G.

01:02:56

Question 14

At what organizational level are EC2 services managed by customers?

Options:

A.

Data center

B.

Regional

C.

Global

D.

Continental

Question 15

Which AW5 1AM policy element indicates the API that is in scope?

Options:

A.

Effect

B.

Version

C.

Action

D.

Resource

Question 16

An analyst investigating a malicious application determines that it runs using AVVS Lambda. What challenge will the analyst likely encounter during the Investigation?

Options:

A.

Application Is no longer active

B.

Hardware raps are misconfigured

C.

Large amounts of log data

D.

Server is poorly managed

Question 17

A client was responsible for their environment's OS, then they delegated this responsibility to their cloud provider. Which of the following migrations could describe this scenario?

Options:

A.

On-prern to UdS

B.

SaaStoOn-prem

C.

IaaS to PaaS

D.

PaaS to SaaS

Question 18

What Amazon EC2 instance prefix should be monitored to detect potential crypto mining?

Options:

A.

C

B.

P

C.

R

D.

I

Question 19

Which statement describes a zld.metal EC2 instance?

Options:

A.

It Is an accelerated computing system with a GPU or I PGA

B.

The system can be configured to add resources at a trigger point

C.

It is a high-frequency system with very fast RAM access

D.

The system is optimized for a high CPU-to-memory ratio

Question 20

Which cloud service provider produces sampled flow logs?

Options:

A.

GCP

B.

Azure

C.

AWS

Question 21

What is shown in the screenshot?

Options:

A.

Google threat types

B.

Windows event channels

C.

Mitre ATT&CK tactics

D.

CIS critical controls

Question 22

At what point of the OAuth delegation process does the Resource Owner approve the scope of access to be allowed?

Options:

A.

After user credentials are accepted by the Authorization Server

B.

Once the OAuth token is accepted by the Application

C.

When the Resource Server receives the OAuth token

D.

Before user credentials are sent to the Authentication Server

Question 23

Using the SOF-ELK instance at 10.0.1.7:5601, inspect the netflow logs related to the ip 5.62.19.62.

Which of the ports seen in the netflow logs associated with the ip 5.62.19.62 has the lowest count?

Hint: Use a wide time frame such as 20 years to ensure all the relevant data is in the scope.

Options:

A.

2341

B.

389

C.

443

D.

49555

E.

80

F.

2222

G.

2374

Question 24

An engineer is looking for the log of API calls recorded by CloudTrail for the past 6 months. Where should they look for the oldest data?

Options:

A.

Lambda ephemeral storage

B.

S3 bucket

C.

requestParameters

Page: 1 / 6
Total 82 questions