Forensic Investigation in Cloud CCSE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A forensic investigator is handling a case where a cloud VM is suspected of containing evidence of fraud. The VM is in a region that is subject to data sovereignty laws. The investigator needs to acquire the VM's disk and memory while preserving the chain of custody. The cloud provider offers a snapshot API and a memory dump feature. The legal team requires that the evidence be stored in a specific country. What is the best approach?

   • ATake only a disk snapshot and store it in the VM's original region.
   • BCopy the VM's disk to a local forensic workstation and analyze it there.
   • CAsk the cloud provider to perform the investigation and provide a report.
   • DTake a snapshot of the disk and a memory dump, then store both in a storage bucket in the required country.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A forensic analyst is investigating a breach in a multi-tenant cloud environment. The analyst needs to collect evidence from a shared physical host. Which challenge is unique to cloud forensics in this scenario?

   • AThe analyst must image the entire host disk
   • BThe analyst must obtain a warrant to access the host
   • CThe analyst may not have access to the physical host
   • DThe analyst must use a write blocker
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During an incident response in a hybrid cloud environment, the team discovers that an on-premises server and an AWS EC2 instance are both compromised. The team needs to preserve evidence from both environments. Which approach is most appropriate?

   • AFocus on the on-premises server because it is more likely to contain evidence
   • BFollow the same forensic process but adapt the tools to each environment
   • CUse the same forensic toolkit for both environments to ensure consistency
   • DIsolate both systems and wait for law enforcement to collect evidence
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In a cloud-based incident, what is the primary goal of the containment phase?

   • ATo collect all forensic evidence.
   • BTo identify the root cause of the incident.
   • CTo limit the spread of the incident and prevent further damage to cloud resources.
   • DTo restore systems to normal operation.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of a forensic report in a cloud investigation?

   • ATo provide a technical guide for remediating the cloud environment.
   • BTo serve as a backup of the collected evidence.
   • CTo document findings, evidence, and conclusions in a clear and defensible manner for stakeholders and legal proceedings.
   • DTo list all the tools used during the investigation.
   Reveal Solution Discussion Select an answer first