NEW
Font size
WorksheetsFORGC1
Total questions: 22
Worksheet time: 11mins
What field allows analysts to track individual emails through various log entries when investigating IMAP clients that use the Bind operation?
Message ID
MailboxUPN
Mailbox Trace
MessageGUID
Which PowerShell command would a security admin run to determine whether Exchange mailbox auditing was enabled?
Get-Mailbox –Identity admin
Search-Mailbox [[-Identity] <MailboxIdParameter>]
Search-Mailbox [[-Identity] ]
Get-OrganizationalConfig | Format-List AuditDisabled
Get-OrganizationalConfig | Format-List AuditDisabled
Search-UnifiedAuditLog
What two components are required to make a call to the Graph API and obtain an authorization token?
Tenant ID and authToken
Application ID and client secret
Application ID and client ID
Scope and operation result
What is an important consideration for DFIR when investigating incidents involving containers like Kubernetes or Docker?
Containers make it easier to perform forensics due to their lightweight footprint.
Specialized tooling and configurations are not required for full visibility.
All log data may be purged on container exit.
Access to logs must be negotiated with the cloud provider up front.
Which of the following is the customer responsible for in the shared responsibility model of the cloud, regardless of cloud type?
Responses
Logical and physical network configuration
Physical datacenter
Information and data
Operating system and physical hosts
What is an important financial consideration when planning to store disks and snapshots from forensic investigations in the cloud on a long-term basis?
Disks and snapshots have dynamic pricing based on the number of CPUs and the memory of the VM mapping them.
Disks and snapshots have an initial, one-time cost only.
Disk and snapshots accrue cost only when the virtual machine that maps them is running.
Disks and snapshots accrue cost all the time, until they are deleted.
Which mailbox action would move an email message to the Recoverable Items folder in Exchange?
SoftDelete
MailItemsAccessed
MoveToDeletedItems
HardDelete
What is the intent of the following HTTP request, used to make a REST API call?
PATCH /users/{id | userPrincipalName}
Create new user
Update user properties
Identify user secrets
Delete user
Which HTTP method is used to fetch data from Microsoft Graph API?
PATCH
POST
PUT
GET
Which mailbox access type generates audit events that include each individual email message?
Sync
WebClient
Push
Bind
What action must be taken before you can issue Microsoft 365 commands in PowerShell?
An authenticated session must be established.
PowerShell must be updated to version 7.
An API must include a plaintext client secret.
Microsoft permissions must be set to allow global read.
What should an analyst consider when reviewing Graph API log entries?
Read calls need to be decoded.
Read calls are never involved in attacks.
Read calls are usually not logged.
Read calls are written to multiple locations.
When registering an app in Azure AD, which type of permission is the most permissive?
Organization
Delegated
PrivilegedAccess
Application
Why might a PowerShell search of the Unified Audit Log for SharePoint file access events only produce 100 results?
The SessionCommand parameter was set.
The ResultSize parameter was not specified.
PowerShell returns a max of 100 results.
The wrong workload was set in the query.
Which of the following Azure AD logs contains a history of tasks performed at the tenant level?
Audit logs
Sign-in logs
Event logs
Security logs
Which type of event can take up to 24 hours to be written to the Microsoft 365 Unified Audit Log?
OneDrive
Exchange
SharePoint
Azure AD
Which parameter contains the access token for Microsoft Graph API calls?
Responses
$Headers
$apiUri
$response
$Scope
How long are unified audit logs retained in Microsoft 365 with an E3 license?
365 days
180 days
90 days
30 days
After configuring the Microsoft Graph API and getting admin approval, what is the next step before the Graph API can be called?
Call the Graph API
Request an access token
Configure permissions
Register the application
Which Graph API call can be used to retrieve a single email message?
Responses
From a DFIR perspective, what is important about infrastructure as a service (IaaS)?
Operating system logs from virtual machines are not available.
The cloud provider is responsible for the security of virtualized resources.
The customer is responsible for enabling and storing logs.
The IaaS billing model is based on flat-rate tiers.
Once a mailbox has been compromised, bad actors will frequently set a mail forwarding rule in order to get a copy of each email. What is the best solution to prevent this attacker technique?
Disable auto-forwarding at the domain level
Disable all forwarding of emails
Delete any forwarding rules set by the attacker
Disable auto-forwarding at the mailbox level
