Cloud Forensics CHFI Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An investigator needs to collect virtual machine (VM) disk images from an IaaS environment for analysis. The VMs are running in a public cloud. Which method is most appropriate for acquiring non-volatile evidence?

   • ARequest the physical hard drive from the cloud provider's data center.
   • BUse a forensic tool to perform a live acquisition of the VM's memory over the network.
   • CCreate a snapshot of the VM disk using the cloud provider's snapshot feature, then export the snapshot as a disk image.
   • DLog into the VM and copy all files to a local forensic workstation using a file transfer protocol.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A government agency uses a community cloud shared with other agencies. An incident occurs, and the agency needs to collect evidence. What is a unique forensic consideration for this deployment model?

   • AThe agency has full physical access to the servers
   • BThere are no legal issues because all agencies are in the same country
   • CEvidence may be commingled with data from other agencies
   • DThe agency can use any forensic tool without restrictions
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a common method for acquiring non-volatile evidence from an IaaS virtual machine?

   • AMonitoring network traffic in real time
   • BCapturing the VM's memory dump
   • CDeleting the VM to preserve its state
   • DTaking a snapshot of the VM's disk
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A multinational corporation operates a hybrid cloud where customer data is processed in a public cloud region in Singapore and archived in a private cloud hosted in Frankfurt. A data breach occurs, and the legal team requires forensic acquisition of the archived data. The private cloud's storage is encrypted at rest with keys held by the corporation. The public cloud provider refuses to release logs without a court order from Singapore. Which forensic approach best addresses the jurisdictional and access constraints?

   • ASeize the physical servers hosting the private cloud in Frankfurt and the public cloud servers in Singapore to ensure complete evidence preservation.
   • BAcquire the encrypted private cloud archive using the corporation's own decryption keys, then request the Singapore logs through the Mutual Legal Assistance Treaty (MLAT) process.
   • CUse a forensic tool to remotely image the private cloud storage over the internet, ignoring the public cloud logs because they are outside the corporation's control.
   • DRequest a snapshot of the entire public cloud environment from the Singapore provider and analyze it locally, bypassing the need for the private cloud archive.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company uses an IaaS platform and suspects a compromised VM. The investigator needs to acquire volatile memory evidence. What is the most appropriate method?

   • APower off the VM and then copy the memory from the host.
   • BTake a snapshot of the VM's disk to capture the memory state.
   • CUse the cloud provider's API to create a memory dump of the VM.
   • DLog into the VM and run a memory capture tool locally.
   Reveal Solution Discussion Select an answer first