Cloud Forensics CHFI Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An investigator is handling a cloud incident where the compromised VM is in a different region than the investigator's location. The VM is running and contains volatile evidence. The investigator has API access but no direct console access. What is the best sequence of actions?

   • APreserve disk snapshots first, then acquire memory, then logs
   • BRequest the provider to power off the VM, then collect everything
   • CAcquire volatile memory via API, then collect logs, then preserve disk snapshots
   • DCollect logs first, then acquire memory, then preserve disk
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company uses a hybrid cloud where sensitive data is stored in an on-premises private cloud and processed in a public cloud. An incident occurs, and evidence is needed from both environments. The legal team is concerned about cross-border data transfer because the public cloud is in another country. What is the most important factor in planning the evidence collection?

   • AThe order in which evidence is collected from each environment
   • BThe cost of cloud storage for evidence
   • CThe type of forensic tools used
   • DThe legal framework governing data transfer between the private and public cloud
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key capability of cloud-native forensic tools provided by cloud service providers?

   • AThey can physically seize servers in the provider's data center
   • BThey can bypass encryption on any cloud data
   • CThey can automatically collect and preserve logs and snapshots across cloud services
   • DThey can access data from any cloud provider without authorization
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An investigator needs to collect volatile evidence from a running cloud VM in an IaaS environment. The VM is critical to the business and cannot be stopped. Which method is most appropriate?

   • AUse a remote memory acquisition tool from within the VM
   • BPower off the VM and copy the virtual disk file
   • CTake a snapshot of the VM's disk
   • DRequest the provider to clone the physical host's memory
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An investigator needs to collect user activity logs from a cloud storage service. The service provides an API for accessing logs. What is the most appropriate method to ensure the logs are preserved as evidence?

   • AUse the API to export the logs and store them in a separate, controlled location with a hash of the exported data.
   • BAsk the cloud provider to email the logs to the investigator's personal account.
   • CPrint the logs and store the paper copies in a secure location.
   • DTake screenshots of the logs displayed in the cloud provider's web console.
   Reveal Solution Discussion Select an answer first