Forensic Investigation in Cloud CCSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A cloud forensic investigator is explaining to a client why cloud forensics is more challenging than traditional digital forensics. Which statement is accurate?

   • ACloud evidence is always volatile and cannot be preserved.
   • BEvidence may be distributed across multiple jurisdictions and data centers.
   • CTraditional forensic tools work exactly the same in the cloud.
   • DCloud providers always provide full access to the underlying physical infrastructure.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is investigating a suspected insider threat in an AWS environment. The analyst needs to determine which IAM user performed a specific API call. Which AWS service should the analyst use?

   • AAWS CloudTrail
   • BAWS Config
   • CAWS Trusted Advisor
   • DAmazon GuardDuty
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A forensic investigator needs to acquire evidence from a cloud storage bucket that may contain files relevant to a legal case. The investigator must ensure the evidence is admissible in court. Which procedure is most important to follow?

   • AAsk the cloud provider to email the files to the legal team.
   • BCopy the files to a local drive and then hash them.
   • CUse the cloud provider's API to download the files and record hashes and timestamps.
   • DTake screenshots of the bucket contents and save them as PDFs.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A multinational company is conducting a forensic investigation that involves personal data of EU citizens stored in a US cloud region. The legal team is concerned about GDPR compliance. What is the primary legal consideration?

   • AThe cloud provider is solely responsible for GDPR compliance.
   • BThe data must be moved to an EU region before any analysis.
   • CThe investigation must be halted until the data is anonymized.
   • DThe transfer of personal data outside the EU must comply with GDPR transfer mechanisms.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a unique challenge of cloud forensics compared to traditional digital forensics?

   • AThe investigator must always obtain a physical warrant before any data collection.
   • BThe investigator may not have physical access to the storage media, relying instead on provider APIs or snapshots.
   • CThe investigator must always use write-blockers to prevent data modification.
   • DThe investigator must only analyze data from a single virtual machine.
   Reveal Solution Discussion Select an answer first