Cloud Forensics CHFI Practice Questions (Page 11)

Questions 51–53

1. 51application · medium

   During a cloud incident investigation, the investigator needs to preserve volatile evidence from a running VM in an IaaS environment. What is the most appropriate method?

   • ATake a snapshot of the VM's disk to capture the current state.
   • BPower off the VM immediately to preserve the disk state.
   • CUse the cloud provider's API to capture a memory dump of the VM.
   • DCopy the VM's configuration files to a forensic workstation.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   An investigator is analyzing a cloud environment and needs to correlate network traffic with user activity logs. Which tool is most appropriate?

   • AA disk imaging tool to create images of all VMs.
   • BA SIEM tool that ingests both network flow logs and user activity logs, allowing correlation.
   • CA packet analyzer that captures live traffic from the cloud network.
   • DA password cracking tool to access user accounts.
   Reveal Solution Discussion Select an answer first
3. 53application · medium

   An organization uses a PaaS platform to run a custom application. The application stores data in a managed database. An incident occurs, and the investigator needs to collect database logs. What is the most likely method?

   • AUse a network sniffer to capture database traffic
   • BAccess the database through the PaaS management console or API
   • CConnect to the underlying VM and extract logs
   • DRequest physical access to the database server
   Reveal Solution Discussion Select an answer first