After creating an EBS snapshot for forensic analysis, what is the typical next step to examine the file system?

Mount the snapshot directly to an EC2 instance.

Download the snapshot to a local machine and mount it as a loop device.

Create a new EBS volume from the snapshot and attach it to a forensic instance.

Use the AWS CLI to copy the snapshot to an S3 bucket and then mount it.

GIAC Cloud Forensics Responder

Domain 4Objective 2

AWS Networking, VMs, and Storage GCFR Practice Questions (Page 8)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

7concepts

Questions 36–36

36foundation · easy
After creating an EBS snapshot for forensic analysis, what is the typical next step to examine the file system?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

AWS Networking, VMs, and Storage GCFR Practice Questions (Page 8)

Questions 36–36

After creating an EBS snapshot for forensic analysis, what is the typical next step to examine the file system?

Keep studying — Amazon Web Services Forensics