Forensic Investigation in Cloud CCSE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A multinational company stores customer data in AWS us-east-1 and eu-west-1. A forensic investigation requires collecting logs from both regions for a legal case in the EU. The company's legal team warns that data transfer outside the EU may violate GDPR. Which action best addresses the legal constraint while preserving evidence?

   • ACollect the logs from us-east-1 and transfer them to eu-west-1 for analysis
   • BAnalyze the logs in each region separately and only transfer aggregated, non-personal findings to the legal team
   • CCollect the logs from eu-west-1 and transfer them to us-east-1 for centralized analysis
   • DRequest the cloud provider to copy the logs to a single region of the company's choice
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary legal purpose of a cloud service agreement (CSA) in the context of forensic investigations?

   • ATo guarantee that the provider will never delete customer data.
   • BTo define the rights and responsibilities of the customer and provider regarding data access and cooperation during investigations.
   • CTo require the customer to use only the provider's forensic tools.
   • DTo transfer all legal liability for data breaches to the provider.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is investigating a breach in a Kubernetes cluster running on a cloud platform. The team needs to collect forensic evidence from container logs, pod configurations, and the underlying node's disk. The cluster is production-critical and cannot be stopped. Which approach balances evidence collection with operational continuity?

   • AStop the cluster and take a full snapshot of all nodes.
   • BOnly collect container logs and ignore the node's disk.
   • CUse a third-party tool that requires installing an agent on each node.
   • DCollect logs and configurations using kubectl, and take a snapshot of the node's disk.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A forensic analyst is investigating a security incident in an AWS environment. The analyst needs to analyze network traffic logs that are stored in S3. Which tool or service is most appropriate for this analysis?

   • AAmazon Inspector
   • BAWS Shield
   • CAWS CloudTrail
   • DAmazon Athena
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which legal or regulatory consideration is especially relevant when conducting a cloud forensic investigation that involves data stored in multiple countries?

   • AThe cloud provider's internal security policies
   • BData residency and cross-border data transfer laws
   • CThe need to obtain a credit card for cloud services
   • DThe requirement to use only open-source forensic tools
   Reveal Solution Discussion Select an answer first