Forensic Investigation in Cloud CCSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the most accurate definition of cloud forensics?

   • AThe use of forensic tools to monitor live network traffic within a cloud VPC for suspicious activity.
   • BThe application of digital forensics principles to acquire, preserve, and analyze data from cloud environments, considering the shared responsibility model and multi-tenant architecture.
   • CThe process of physically seizing cloud servers from a data center to perform offline analysis.
   • DThe legal process of obtaining a warrant to access data stored in a public cloud provider's data center.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During an incident in a Kubernetes cluster running on Google Kubernetes Engine (GKE), a forensic analyst needs to capture the state of a compromised pod before it is deleted. Which approach best preserves the pod's forensic data?

   • AUse kubectl exec to run a memory dump command inside the pod
   • BTake a snapshot of the underlying node's disk
   • CDelete the pod and rely on the cluster's audit logs
   • DScale the deployment to zero replicas
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the first step in the incident response process as applied to a cloud-based incident?

   • AEradication
   • BRecovery
   • CPreparation
   • DContainment
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An incident responder needs to collect volatile data from a Windows VM in Azure. The VM is running and the responder has administrative access. Which method is most appropriate for collecting memory evidence?

   • AStop the VM and then use Azure Backup to capture the disk
   • BUse the Azure Serial Console to run a memory dump command
   • CUse a remote forensic tool such as F-Response or a custom agent to dump memory
   • DUse Azure Disk Encryption to encrypt the disk before capture
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company's cloud environment has experienced a suspected data breach. The incident response team needs to preserve evidence while minimizing business disruption. Which action should be taken first?

   • ADelete the affected resources to prevent further damage.
   • BIsolate the affected resources while preserving their state.
   • CImmediately shut down all affected cloud resources.
   • DNotify the cloud provider and ask them to take over the investigation.
   Reveal Solution Discussion Select an answer first