Pass GIAC GCFR Actual Free Exam Q&As Updated Dump Oct 25, 2023 [Q45-Q69]

Q45. Which of the following Windows agents would need to be configured on an Azure VM for an investigator to query Its operating system logs sent to Azure Storage?

Q46. An analyst is reviewing a case involving an actor who leveraged PowerShell Cloud Shell to achieve their goals. Where can the analyst And logs depleting this activity?

Q47. An engineer is troubleshooting a complaint that a web server in AWS cannot receive incoming traffic, but the server can connect to the internet otherwise. What is needed to solve this problem?

Q48. What will the following command do?
Install nodule -Name ExchangeOnlineManagement

Q49. What would prevent GCP 1AM from linking to Google Workspace to manage users and groups?

Q50. The attack technique “Access Kubelet API” falls under which Mitre ATT&CK tactic?

Q51. What can be inferred about the ARN below?
arn:aws:!am::457787814323:user/giac

Q52. Use Kibana to analyze the Azure AD sign-in logs in the azure-* index. On March 31st, 2021, what is the timestamp of the earliest failed login attempt for the account dcr0ss5pymtechlabs.com?
ViewVM

Q53. Which of the following is the smallest unit of computing hardware in Kubernetes?

Q54. What unique identifier is used by AWS to identify a specific account and allow integration with external organizations?

Q55. A cloud administrator needs to determine which user account allowed SSH Inbound from the internet on an Azure Network security group. Which type of log does the administrator need to examine?

Q56. What is shown in the screenshot?

Q57. In Azure, which of the following describes a “Contributor”?

Q58. An investigator his successfully installed the ExchangeOnlineManagement module on their investigation system and is attempting to search a client’s Microsoft 365 Unified Audit Log using PowerShell. PowerShell returns a “command not found” error each time they try to execute the Search-UnifiedAuditLog cmdlet. How should the investigator troubleshoot this issue?

Q59. Which AWS authentication method provides temporary, limited privilege credentials for 1AM users or federated users?

Q60.

Q61. What is the expected time delay for Azure AD logs to become searchable in the Microsoft 365 Unified Audit Log?

Q62. Access Kibana via http://10.0.1.7:5601 and use the *ws-* index pattern. Use the time range 2021-03-01 00:00 UTC to 2021 04 U 00:00 UTC. How many ec2 DescribMnstantp*; events were performed by the root user?

Q63. Which AWS policy type specifies the maximum resource permissions for in organization or organizational unit (OU)?

Q64. Which cloud model should an organization negotiate access to logs as pert of contract negotiation prior to using the service?

Q65. The Azure URI for the Develop VM is shown below. What will change in the notation when referencing the VM’s OS disk?

Q66. In which scenario would an investigator collect NetFlow logs rather than PCAP logs?

Q67. What is the lowest level of GCP organization that consists of a logical grouping of services?

Q68. How is storage account, cs21003200042c87633, created in an Azure resource group?

Q69. What is a best practice recommendation when using API keys for AWS access?