Cloud Forensics CHFI Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A multinational company uses a SaaS email platform. During an investigation, the legal team needs to obtain emails from a user account that is stored in a data center located in another country. What is the most important legal consideration before requesting the data?

   • AThe data sovereignty and cross-border data transfer laws
   • BThe data center's physical security measures
   • CThe email platform's storage quota
   • DThe user's password reset policy
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company in the EU uses a public cloud provider with data centers in the US and EU. An incident involves personal data of EU citizens. The investigator must collect evidence while complying with GDPR data transfer rules. What is the most appropriate approach?

   • AUse a third-party tool that automatically replicates data to multiple regions for redundancy.
   • BTransfer all relevant data to the US data center for analysis because the provider is a US company.
   • CCollect evidence only from the US data center to ensure the provider's legal obligations are met.
   • DEnsure that evidence is collected and processed within the EU region, using the provider's EU data center and local processing tools.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An investigator is working on a case involving a public cloud where the suspect's data is stored in multiple regions. The investigator has a warrant for one region but not the others. What is the most appropriate action?

   • ACollect evidence only from the region covered by the warrant and document the existence of data in other regions for potential legal follow-up.
   • BCollect evidence from all regions because the warrant is for the suspect's account.
   • CAsk the cloud provider to move the data from other regions to the covered region.
   • DIgnore the data in other regions because it is not covered by the warrant.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company operates a private cloud for its internal use. An incident occurs, and the investigator needs to collect evidence. What is the primary advantage of the private cloud in this scenario?

   • AThe private cloud uses only dedicated physical hardware, eliminating multi-tenancy issues.
   • BThe company has direct control over the infrastructure, allowing for physical access to servers if needed.
   • CThe private cloud is automatically exempt from all legal regulations.
   • DThe private cloud provider retains all logs indefinitely.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After a cloud incident, the investigator has collected logs, disk images, and memory dumps. What is the next step in the forensic process?

   • ADelete any irrelevant evidence to streamline the investigation.
   • BReport the findings to law enforcement before analysis.
   • CAnalyze the collected evidence to identify the cause and impact of the incident.
   • DPreserve the evidence by making additional copies.
   Reveal Solution Discussion Select an answer first