312-49V11 · Question #29
Stella, a forensic investigator, is analyzing logs from a cloud environment to determine if a password leak has led to the disabling of a user account. She suspects that a change in the login…
The correct answer is B. protopayload.resource.labels.service="login.googleapis.com". This question aligns with CHFI v11 objectives under Cloud Forensics, particularly Google Cloud audit log analysis and authentication event investigation. In Google Cloud Platform (GCP), authentication-related events--such as login attempts, failed authentications, suspicious…
Question
Stella, a forensic investigator, is analyzing logs from a cloud environment to determine if a password leak has led to the disabling of a user account. She suspects that a change in the login settings may have triggered the account to be locked due to multiple failed login attempts. To verify her hypothesis, she applies various filters to examine the cloud audit logs. Which of the following filters would help Stella identify if a password leak has disabled a user account?
Options
- Aprotopayload.metadata.event.parameter.value=DOMAIN_NAME
- Bprotopayload.resource.labels.service="login.googleapis.com"
- ClogName="organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Factivity"
- Dprotopayload.resource.labels.service="admin.googleapis.com"
How the community answered
(35 responses)- A3% (1)
- B74% (26)
- C9% (3)
- D14% (5)
Explanation
This question aligns with CHFI v11 objectives under Cloud Forensics, particularly Google Cloud audit log analysis and authentication event investigation. In Google Cloud Platform (GCP), authentication-related events--such as login attempts, failed authentications, suspicious access behavior, and account lockouts--are handled by the Google Login API service. CHFI v11 emphasizes that when investigators are examining suspected credential compromise or password leaks, they must focus on authentication and identity-related logs rather than general administrative or configuration logs. The filter protopayload.resource.labels.service="login.googleapis.com" targets audit log entries generated by the login service, which records successful and failed login attempts, abnormal authentication behavior, and security enforcement actions such as temporary account lockouts caused by repeated failed logins. These events are critical indicators when determining whether a password leak resulted in account disabling.
Topics
Community Discussion
No community discussion yet for this question.