Which of the following components determines where packets are sent when Packet Mirroring is configured in Google Cloud?

• • Backend instances

• • Load balancer

• • Flow configuration

• • Mirror Policy

Answer explanation

Network traffic is captured from a computer service and passed to a load balancer forwarding rule, which then determines how the capture of traffic is sent to other backend services. This is very similar to how you might load-balance inbound traffic to multiple web services; however, in this case, you are balancing mirrored traffic from computer services.

What is a benefit of using Pub/Sub to export Google Cloud logs?

• Messages are securely deleted if they cannot be delivered.

• Logs are pushed to a third-party service via FTP.

• Messages will be retained if they cannot be delivered.

• It provides an RSS feed to subscribe to your logs.

Answer explanation

One of the benefits of using Pub/Sub is the ability to queue messages or retain messages for a period of time. This can be useful during outages or network issues with a third-party service where you are shipping the logs.

Into which of the following formats does the GCP Logging Agent transform collected data so that the Google Logging API can consume it?

• 
  

• EVTX

• YAML

• JSON

• ASCII

Answer explanation

The Logging Agent relies on consuming host logs from applications on the VM and transforming them into JSON data to be consumed by the Google Logging API.

An analyst would like to ensure that two similar log entries are not duplicates. Which of the following fields should they use to ensure they are not looking at duplicate entries?

• cs_object

• • cs_user_agent

• • cs_bucket

• • s_request_id

Answer explanation

The s_request_id field is unique for each event that appears in the Usage Logs. s_request_id should be used to ensure Google Cloud has not mistakenly produced a duplicate log entry across multiple Usage Log files, which can occur.

What are policies applied to in Google Cloud?

• Group

• Members

• Resources

• Organization

Answer explanation

A policy is made from the binding of members and roles, which are grouped into a single policy object. This is then applied to one or many resources within GCP.

Policies are not applied to members! This is one of the fundamental differences of GCP compared to AWS and Azure. You cannot query a member and determine all the permissions that a member may have. You can only query a resource to determine who has permissions for that resource; this is because the resource has the policy applied to it.

Which cloud model includes Google’s Cloud Run?

• FaaS

• IaaS

• PaaS

• SaaS

Answer explanation

In the platform-as-a-service (PaaS) compute model, the underlying operating system is already managed with an application layer sitting on top of it that you can configure. Examples are Google Kubernetes Engine (GKE) and Cloud Run.

In Google Cloud, how can a DFIR investigator view all the permissions of a member?

• Query the resources to see all the members that can access them and their permissions

• Query the member to see all their permissions

• Query the member to see all the resources they could possibly have access to

• Submit a request to Google

Answer explanation

To understand the permissions a member may have, you have to query resources. This can have some benefits from an investigative perspective. It means if you know a specific resource was abused, you can simply query the permissions that resource has assigned and see all the members that can access it and what their permission level is on that resource.

An attacker who scans all of Google Cloud for possible buckets to attack based on keywords is in what part of the attack phase?

• Escalate

• Reconnaissance

• Orientate

• Steal

Answer explanation

Reconnaissance is the first phase of an attack. In this step, the threat actor scans Google Cloud for possible buckets based on keywords. Reconnaissance is followed by the orientate, steal, and escalate phases.

Google Cloud allows which two standard options for Identity and Access Management (IAM)?

• Cloud OAuth or Google Authenticator

• Cloud Identity or Google Workspace

• Cloud Directory or Google Passthrough

• Cloud Users or Google Sessions

Answer explanation

When you set up Google Cloud, you will need to determine how authentication for members is managed. Google Cloud provides you with two standard options: either the IAM service within Google Cloud (referred to as Cloud Identity) or Google Workspace.

Which of the following permissions allow privilege escalation within Google Cloud buckets?

• allAuthenticatedUsers

• allUsers

• legacyBucketOwner

• legacyBucketWriter

Answer explanation

Escalating privileges with Cloud Buckets occurs when the “allUsers or “allAuthenticatedUsers” members are given the “legacyBucketOwner” policy. With this policy, they can “setIamPolicy” on a Bucket to be a Storage Admin, which can allow buckets to be deleted.