Forensic Investigation in Cloud CCSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which element is essential to include in a cloud forensic report to ensure its credibility?

   • AA detailed timeline of events and actions taken during the investigation.
   • BA list of all employees who had access to the cloud account.
   • CThe personal opinions of the investigator about the incident.
   • DThe cloud provider's internal security logs.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which tool is specifically designed for memory forensics and can be used to analyze a memory dump from a cloud VM?

   • ANmap
   • BVolatility
   • CWireshark
   • DMetasploit
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During an incident response, a cloud administrator needs to collect non-volatile evidence from a compromised virtual machine. Which of the following is the most appropriate method?

   • ARun 'netstat' to capture active network connections.
   • BCollect the VM's memory dump.
   • CUse 'ps' to list running processes.
   • DCapture a snapshot of the VM's disk.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is investigating a data breach that involved an Azure SQL database. The database has automated backups enabled, but the legal team requires evidence that the backups have not been tampered with. Which action best ensures the integrity of the backup evidence?

   • ARestore the backup to a new server and compare checksums with the original
   • BAsk the database administrator to confirm the backups are valid
   • CEnable Azure Backup's soft delete and immutability features
   • DCopy the backup files to a local network share
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is investigating a suspected compromise of a Linux virtual machine in Azure. The VM is still running. The analyst needs to capture volatile data that could be lost if the VM is shut down. Which action should the analyst take first?

   • AUse a memory acquisition tool over SSH to capture RAM contents before any further actions.
   • BUse Azure Bastion to connect and run 'dmesg' to capture kernel logs.
   • CCreate a snapshot of the OS disk using the Azure portal.
   • DConnect to the VM via SSH and run the 'memory dump' command to collect RAM.
   Reveal Solution Discussion Select an answer first