WorksheetsFORGCF5
Total questions: 27
Worksheet time: 14mins
Which of the following components determines where packets are sent when Packet Mirroring is configured in Google Cloud?
Backend instances
Load balancer
Flow configuration
Mirror Policy
What is a benefit of using Pub/Sub to export Google Cloud logs?
Messages are securely deleted if they cannot be delivered.
Logs are pushed to a third-party service via FTP.
Messages will be retained if they cannot be delivered.
It provides an RSS feed to subscribe to your logs.
Into which of the following formats does the GCP Logging Agent transform collected data so that the Google Logging API can consume it?
EVTX
YAML
JSON
ASCII
An analyst would like to ensure that two similar log entries are not duplicates. Which of the following fields should they use to ensure they are not looking at duplicate entries?
cs_object
cs_user_agent
cs_bucket
s_request_id
What are policies applied to in Google Cloud?
Group
Members
Resources
Organization
Which cloud model includes Google’s Cloud Run?
FaaS
IaaS
PaaS
SaaS
In Google Cloud, how can a DFIR investigator view all the permissions of a member?
Query the resources to see all the members that can access them and their permissions
Query the member to see all their permissions
Query the member to see all the resources they could possibly have access to
Submit a request to Google
An attacker who scans all of Google Cloud for possible buckets to attack based on keywords is in what part of the attack phase?
Escalate
Reconnaissance
Orientate
Steal
Google Cloud allows which two standard options for Identity and Access Management (IAM)?
Cloud OAuth or Google Authenticator
Cloud Identity or Google Workspace
Cloud Directory or Google Passthrough
Cloud Users or Google Sessions
Which of the following permissions allow privilege escalation within Google Cloud buckets?
allAuthenticatedUsers
allUsers
legacyBucketOwner
legacyBucketWriter
What open-source tool was developed to map out all possible resources that can be compromised by compromising a single service account in Google Cloud?
resourcePivTR
gcploit
XploitGCloud
servicesploit
Why is it not possible to carve files from unallocated space on a snapshot of a virtual machine exported from Google Cloud?
Unallocated space is not exported to a snapshot.
Unallocated space is encrypted in a snapshot.
Unallocated space is wiped in a snapshot.
Unallocated space is compressed in a snapshot.
When setting up Google Workspace to work alongside GCP IAM, which group is required to link Google Workspace to Google Cloud?
gcp-security-admins
gcp-network-admins
gcp-organization-admins
gcp-devops
In Google Cloud, which of the following data structures does Pub/Sub use to deliver a message in a POST request to an endpoint when push messaging is enabled?
YAML
XML
JSON
ASCII
A user would like to create a VM in Google Cloud with a virtualized Trusted Platform Module. Which of the following VM types should be used?
Secure VMs
GPU
Preemptible VMs
Shielded VMs
What type of access is required for an account that will be used to query and collect Google Cloud logs for the DFIR team?
Private Logs Viewer
Logs Bucket Writer
Logs Viewer
Platform Viewer
What Google Cloud native tool can be used for viewing, parsing, and analyzing log data?
Log Viewer
Syslog
Event Viewer
Log Explorer
An analyst has identified mismatches between Google Cloud VPC Flow Logs and traffic that left the VPC. What is the most probable explanation for this finding?
There may be a misconfiguration at the VPC Flow.
Traffic logged in VPC Flow Logs may be blocked at the firewall.
Performance issues at the firewall may have dropped logs.
There may be a misconfiguration at the firewall.
What allows a Google Cloud administrator to collect and send logs from Linux and Windows VM instances to the logging platform for the specific project the VM is within?
Syslog
Log monitoring
Ops Agent
Agentless log collection
What is the highest object in the overall structure of a Google Cloud instance?
Project
Folders
Resources
Organization
An analyst wants to enable the Usage and Storage Logs for individual buckets to track unauthenticated access to objects within a bucket. What can be used to enable this function?
gsutil
secure shell
web console
google workspace
What Google Cloud IAM permission allows for performing actions on behalf of another account or resource?
actAs
userRun
runAs
stepUp
Which of the following Google Cloud logging buckets cannot be modified by a user or an administrator?
_Storage bucket
_Logs bucket
_Default bucket
_Required bucket
Once a Google Cloud storage bucket is created, what cannot be changed?
Description
Retention time
Storage location
Name
For how long does Google provide organizations free log storage?
90 days
30 days
7 days
60 days
An analyst reviews Google Cloud VPC Flow Logs and concludes that some packets are missing. What is the most probable explanation for this phenomenon?
Misconfigured logging
Performance issues in Google Cloud
DDoS attack on VPC
VPC Flow Logs are only sampled.
In Google Cloud, what determines whether a log event is recorded or discarded?
Buckets
Cloud logging API
Log sinks
External platforms
