Cloud Forensics CHFI Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company uses a SaaS email platform and suspects an employee exfiltrated data. The investigator needs to preserve evidence but has no administrative access to the underlying servers. What is the most appropriate first step for evidence acquisition?

   • AIntercept network traffic between the employee and the SaaS platform to reconstruct email activity.
   • BRequest a forensic image of the physical server hosting the email service from the provider.
   • CPerform a memory dump of the employee's workstation to capture the email content from the browser cache.
   • DUse the SaaS provider's eDiscovery or export API to retrieve the employee's mailbox data and associated audit logs.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the first step in a structured cloud forensic process?

   • AAnalysis of collected data
   • BIdentification of potential evidence sources
   • CReporting findings
   • DPreservation of evidence
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A global company uses a SaaS collaboration platform. An investigation requires access to user data stored in a data center in a foreign country. The company's legal team is concerned about data sovereignty. The provider offers data residency options in multiple regions. What is the most effective approach to address the legal concern while enabling the investigation?

   • ARequest the provider to move the data to the company's home country data center
   • BUse a VPN to access the data center directly
   • CObtain legal advice and follow the appropriate legal process for cross-border data access
   • DProceed with accessing the data without considering local laws
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A government agency uses a community cloud shared with other agencies. An incident occurs, and the investigator needs to collect evidence. What is the primary forensic challenge in this environment?

   • AThe community cloud provider does not retain any logs, so evidence must be collected from individual agency systems.
   • BData from multiple agencies may be co-located, requiring careful isolation to avoid cross-contamination of evidence.
   • CThe community cloud is not subject to any legal jurisdiction, making evidence collection impossible.
   • DThe investigator must obtain permission from all community members before collecting any evidence.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An investigator is trying to acquire evidence from a cloud VM that uses full-disk encryption. The investigator has the VM's administrative credentials. What is the most effective way to access the data?

   • APerform a live acquisition from within the OS while it is running
   • BUse a brute-force attack on the encryption
   • CRequest the provider to disable encryption
   • DCopy the virtual disk file and decrypt it offline
   Reveal Solution Discussion Select an answer first