CHFI Application, Email and Cloud Forensics Practice Question
During a forensic investigation of a Google Cloud Platform (GCP) environment, an analyst reviews Audit Logs and sees a log entry with the method 'storage.objects.list' and a principal email 'attacker@gmail.com'. However, the identity is not from the organization's domain. What should the analyst conclude?
⚠ Common exam trap
EC-Council often tests the misconception that Audit Logs can be spoofed or that external identities cannot appear in logs unless there is a logging error, but the correct understanding is that GCP Audit Logs faithfully record the authenticated identity, and an external email indicates a real IAM permission grant.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An external identity was granted IAM permissions on the bucket, possibly through a misconfigured resource.
In GCP, Audit Logs record the actual identity used to authenticate the API call. The presence of 'attacker@gmail.com' as the principal email indicates that an external Google account (not part of the organization's domain) was granted IAM permissions on the bucket, likely through a misconfigured resource policy (e.g., a bucket-level IAM policy that allows allUsers or a specific external user). This is a common cloud security misconfiguration where overly permissive IAM bindings are applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The analyst must immediately shut down the bucket.
Why it's wrong here
Shutting down the bucket is an incident response action, not a forensic conclusion. The log indicates a potential IAM misconfiguration, but the analyst should first preserve evidence, assess the scope, and determine whether the bucket is actually publicly accessible or if the external identity is authorized. Premature shutdown could destroy ephemeral data and disrupt services without confirming the threat.
- ✗
The attacker spoofed the principal email in the log.
Why it's wrong here
Cloud Audit Logs in GCP are generated by the authentication layer; the principal email is derived from the authenticated identity token. GCP's Security Command Center and Cloud Audit Logs rely on cryptographically signed credentials, so an attacker cannot simply forge the principal field. A spoofed email would require compromising the identity provider or the service account key, which is a different attack vector than IAM misconfiguration.
- ✓
An external identity was granted IAM permissions on the bucket, possibly through a misconfigured resource.
Why this is correct
The presence of an external email address in the principal field of the Cloud Audit Log entry indicates that an IAM policy binding grants permissions to an identity outside the organization. This often happens when a bucket has been made public or when a resource-level IAM policy accidentally includes an external user or allUsers/allAuthenticatedUsers. The analyst should examine the bucket's IAM policy using `gcloud iam policies get` or the Cloud Console to identify the exact binding.
- ✗
The log entry is a false positive due to a logging error.
Why it's wrong here
Cloud Audit Logs are designed to be highly reliable and tamper-evident, with logs streamed to Cloud Storage or BigQuery for retention. A false positive due to a logging error is unlikely because the log entry is generated upon an actual API call that was authenticated and authorized under the given identity. Logging errors typically manifest as missing entries, not fabricated ones with coherent principal and resource fields.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.