Cloud Forensics CHFI Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does multi-tenancy in a cloud environment affect forensic investigations?

   • AIt makes it easier to obtain a complete physical image of the server
   • BIt ensures that evidence from one tenant is automatically isolated from other tenants
   • CIt may complicate evidence acquisition because data from multiple tenants can be co-located on the same physical infrastructure
   • DIt eliminates the need for a warrant to access cloud data
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A multinational company uses a public cloud with data centers in multiple countries. An incident involves data stored in a country with strict data sovereignty laws. The investigator needs to collect evidence. What is the most important consideration?

   • AAsk the cloud provider to delete the data to avoid legal complications.
   • BEnsure that evidence collection complies with the data sovereignty laws of the country where the data resides.
   • CTransfer all data to the company's headquarters for analysis, regardless of local laws.
   • DIgnore the local laws because the company is based in another country.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After collecting evidence from a cloud environment, the investigator must ensure the evidence is admissible in court. What is the most important step in this process?

   • ADocument the chain of custody, including who collected the evidence, when, and how it was handled.
   • BShare the evidence with all parties involved before analysis is complete.
   • CDelete any irrelevant data to simplify the case.
   • DCompress the evidence files to save storage space.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company uses a PaaS platform to host a custom application. An incident occurs, and the investigator needs to collect application logs and configuration data. What is the most appropriate method?

   • AUse the PaaS provider's logging and configuration export features to retrieve the data.
   • BAccess the underlying operating system and file system directly to copy logs.
   • CRequest a forensic image of the physical server running the application.
   • DPerform a memory dump of the application container using a local tool.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an example of volatile evidence in a cloud environment?

   • AA log file stored in a cloud storage bucket
   • BA database backup stored in object storage
   • CA snapshot of a virtual machine's disk
   • DThe contents of a running VM's memory (RAM)
   Reveal Solution Discussion Select an answer first