Cloud Forensics CHFI Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is lack of physical access a challenge in cloud forensics?

   • AInvestigators cannot use any forensic tools in the cloud
   • BCloud providers are always uncooperative
   • CInvestigators cannot directly seize or image physical hardware, so they must rely on provider cooperation and logical access
   • DCloud data is always encrypted, making it impossible to analyze
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In which cloud service model does the customer have the most control over the underlying operating system and network configuration, affecting forensic evidence acquisition?

   • APlatform as a Service (PaaS)
   • BInfrastructure as a Service (IaaS)
   • CFunction as a Service (FaaS)
   • DSoftware as a Service (SaaS)
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which statement best describes the role of cloud forensics in incident response?

   • AIt replaces the need for traditional forensic procedures entirely
   • BIt provides a structured approach to gathering and analyzing evidence from cloud services to determine what happened during an incident
   • CIt is only applicable to public cloud deployments, not private or hybrid
   • DIt focuses solely on collecting evidence from physical hard drives in a data center
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An organization uses a SaaS CRM. An investigation requires access to deleted records. The provider retains backups for 30 days. The investigator needs to recover the deleted data. What is the most appropriate action?

   • AAccess the underlying database directly
   • BUse a data recovery tool on the local machine
   • CAsk the provider for the physical hard drives
   • DRequest the provider to restore the data from backups
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A forensic investigator is handling a case involving a public cloud environment where the suspect used strong encryption on their data. The investigator has legal authority to access the data but lacks the decryption keys. Which approach is most appropriate?

   • ASeek a court order to compel the suspect to provide the decryption keys, while preserving the encrypted data as evidence.
   • BDelete the encrypted data to prevent the suspect from claiming it is evidence.
   • CAttempt to brute-force the encryption using high-performance computing resources.
   • DRequest the cloud provider to bypass the encryption and provide plaintext data.
   Reveal Solution Discussion Select an answer first