Cloud Forensics CHFI Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A forensic investigator is starting an investigation of a security incident in a public cloud environment. The incident involves a compromised VM. What is the first step in the cloud forensic process?

   • ANotify the cloud provider
   • BAcquire a memory dump from the VM
   • CAnalyze the VM's logs
   • DIdentify the scope of the incident and the relevant evidence sources
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An investigator is analyzing a compromised cloud environment and needs to correlate user activity across multiple services (e.g., storage, compute, and identity). Which tool is most appropriate for this task?

   • AA disk imaging tool to create forensic images of all VMs.
   • BA memory forensics tool to analyze the RAM of the investigator's own workstation.
   • CA network packet analyzer to capture traffic between the user and the cloud services.
   • DA cloud-native log aggregation tool that ingests logs from various services and provides a unified query interface.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An investigator needs to acquire evidence from a cloud VM that is part of a clustered application. The VM is running and holds critical volatile data. The investigator has access to the cloud provider's API. The VM is encrypted with a customer-managed key. What is the best approach to preserve volatile evidence while maintaining the VM's availability?

   • APower off the VM and copy the virtual disk
   • BUse the provider's live migration feature to move the VM to another host and then acquire memory
   • CTake a snapshot of the VM's memory using the provider's API
   • DUse a remote memory acquisition tool from within the VM
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A forensic investigator is examining a cloud environment and needs to analyze virtual machine disk images. Which tool is most appropriate for this task?

   • AA log analysis tool that only processes text-based logs.
   • BA forensic imaging tool that supports cloud disk formats (e.g., VHD, VMDK) and can mount the images for analysis.
   • CA password cracking tool to access the VM's login credentials.
   • DA network scanner to identify open ports on the cloud VMs.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A forensic investigator is examining a breach in a hybrid cloud deployment where sensitive customer data is stored in a private cloud on-premises and processing workloads run in a public cloud. The investigator needs to collect evidence from both environments. What is the primary challenge that must be addressed first?

   • AObtaining physical access to the public cloud servers
   • BDetermining which jurisdiction's laws apply to the public cloud data
   • CEnsuring the public cloud provider has enabled encryption for data at rest
   • DCoordinating evidence collection across the private and public cloud environments
   Reveal Solution Discussion Select an answer first