A forensic investigator is preparing to collect evidence from a cloud environment that spans multiple jurisdictions. The investigator must ensure the evidence is admissible in court. Which action is most important?

Use only open-source forensic tools

Collect as much data as possible, regardless of relevance

Rely on the cloud provider's certification of the evidence

Ensure that all evidence collection complies with the laws of each jurisdiction involved

Which method is commonly used to collect non-volatile data from a cloud VM for forensic analysis?

Creating a snapshot of the VM's disk and exporting it to a forensic workstation.

Capturing network packets from the VM's virtual NIC.

Reviewing the VM's console output.

Running the 'volatility' tool on the VM's live memory.

A forensic investigator needs to collect logs from an Azure subscription as part of a legal investigation. The logs must be admissible in court. Which step is most important to ensure the admissibility of the collected logs?

Use Azure Monitor to query the logs and copy the results into a report

Document the collection process, including who accessed the logs, when, and how they were exported

Ask the cloud provider to certify that the logs are authentic

Export the logs to a CSV file and store them on a USB drive

Which of the following is an example of volatile data that a cloud forensic investigator should collect as a priority?

Running processes and network connections from a live cloud VM.

The contents of a cloud storage bucket.

The cloud provider's audit logs.

EC-CouncilCertified Cloud Security Engineer

Domain 5Objective 1

Forensic Investigation in Cloud CCSE Practice Questions (Page 7)

Part of the Cloud Forensics and Resilience domain, which makes up ~17% of our current practice bank.

43questions here

9free pages

7concepts

Questions 31–35

31application · medium
A forensic investigator is preparing to collect evidence from a cloud environment that spans multiple jurisdictions. The investigator must ensure the evidence is admissible in court. Which action is most important?
Select an answer first
32foundation · easy
Which method is commonly used to collect non-volatile data from a cloud VM for forensic analysis?
Select an answer first
33application · medium
A forensic investigator needs to collect logs from an Azure subscription as part of a legal investigation. The logs must be admissible in court. Which step is most important to ensure the admissibility of the collected logs?
Select an answer first
34application · medium
A forensic analyst needs to collect network flow logs from a Google Cloud VPC to investigate a potential data exfiltration. Which tool or service should the analyst use to capture the required data?
Select an answer first
35foundation · easy
Which of the following is an example of volatile data that a cloud forensic investigator should collect as a priority?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCSE” is a trademark of its owner, used for identification only.