GCFR GIAC Cloud Forensics Responder (GCFR) Questions and Answers

What is shown in the screenshot?

The attack technique "Access Kubelet API" falls under which Mitre ATT & CK tactic?

A client was responsible for their environment's OS, then they delegated this responsibility to their cloud provider. Which of the following migrations could describe this scenario?

An analyst investigating a malicious application determines that it runs using AVVS Lambda. What challenge will the analyst likely encounter during the Investigation?

AWS VPC Flow logs are enabled. What do these logs capture?

An attacker successfully downloaded sensitive data from a misconfigured GCP bucket. Appropriate logging was not enabled. Where can an analyst find the rough time and quantity of the data downloaded?

Which cloud service provider produces sampled flow logs?

What would prevent GCP 1AM from linking to Google Workspace to manage users and groups?

What is the maximum file size for Azure Page Blob storage?

After registering the application in Azure AD, what is the next step to take in order to use Microsoft Graph API?

What can be inferred about the ARN below?

arn:aws:!am::457787814323:user/giac

Which is a limitation of AWS Lambdas?

Which AWS policy type specifies the maximum resource permissions for in organization or organizational unit (OU)?

At what organizational level are EC2 services managed by customers?

A cloud administrator needs to determine which user account allowed SSH Inbound from the internet on an Azure Network security group. Which type of log does the administrator need to examine?

An engineer has set up log forwarding for a new data source and wants to use that data to run reports and create dashboards in Kibana. What needs to be created in order to properly handle these logs?

What is the recommended storage type when creating an initial snapshot of a VM in Azure for forensic analysis?

Where are iOS Class keys stored?

At what point of the OAuth delegation process does the Resource Owner approve the scope of access to be allowed?

What unique identifier is used by AWS to identify a specific account and allow integration with external organizations?

An engineer is troubleshooting a complaint that a web server in AWS cannot receive incoming traffic, but the server can connect to the internet otherwise. What is needed to solve this problem?