Forensic Investigation in Cloud CCSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of maintaining a chain of custody for cloud-based evidence?

   • ATo reduce the cost of evidence storage.
   • BTo encrypt all evidence at rest and in transit.
   • CTo prove that the evidence has not been tampered with from the moment of collection to presentation in court.
   • DTo ensure that the cloud provider is notified of the investigation.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team detects suspicious activity on an Azure VM. The incident response plan requires preserving evidence for potential legal action. Which sequence of actions aligns with proper incident response and forensic preservation?

   • ADelete the VM and restore from the last known good backup
   • BIsolate the VM, capture memory, snapshot the disk, and then shut down the VM
   • CShut down the VM immediately, then snapshot the disk and capture memory
   • DSnapshot the disk first, then shut down the VM and capture memory
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A forensic investigation involves data that is subject to a legal hold order. The data resides in a cloud storage service. What must the investigator do to comply with the legal hold?

   • APreserve the data in its current state and prevent any modification or deletion.
   • BEncrypt the data and store the key with the legal team.
   • CWait for the legal team to provide a list of specific files to preserve.
   • DCopy the data to a separate location and then delete the original.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A forensic investigator is examining a serverless application on AWS Lambda. The function's code has been updated multiple times since the incident. Which data source provides the most reliable evidence of what code was executed during the incident?

   • AThe Lambda execution role's permissions policy
   • BCloudTrail logs showing Lambda function version and alias invocations
   • CThe current Lambda function code in the AWS console
   • DThe CloudWatch Logs from the most recent invocation
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic investigator is acquiring evidence from a cloud environment and needs to maintain a clear chain of custody. Which practice is essential?

   • ADocument every person who handles the evidence and when.
   • BStore evidence only in the cloud to avoid physical handling.
   • CEncrypt the evidence and share the key with the legal team.
   • DUse a single investigator for the entire investigation.
   Reveal Solution Discussion Select an answer first