Introduction to Cloud DFIR GCFR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   Your organization uses a SaaS email platform. A user's account was compromised, and the attacker accessed emails and then deleted them. The legal team wants a forensic copy of the mailbox data for potential litigation. Which action should you take first to preserve evidence?

   • AAsk the user to forward all remaining emails to a personal account for safekeeping.
   • BUse the provider's API to extract the raw database files from the email backend.
   • CPlace a litigation hold on the user's mailbox and preserve all related data.
   • DRequest the underlying virtual machine snapshot from the cloud provider.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A government contractor must keep all case data within a specific country due to data sovereignty laws. They also need to burst into additional capacity during peak investigations. Which deployment model best meets both the residency requirement and the elasticity need?

   • ACommunity cloud shared with other contractors in the same country.
   • BPrivate cloud only, hosted in the contractor's own data center in-country.
   • CHybrid cloud with a private cloud in-country and a public cloud region in the same country for burst capacity.
   • DPublic cloud only, using a region in a neighboring country with better pricing.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization uses a cloud-based email service (SaaS). An employee's account is compromised, and emails are being sent without authorization. Which evidence source is most useful for the investigation?

   • AA network packet capture from the company's firewall
   • BA disk image of the email server
   • CThe email service's audit logs and login history
   • DA memory dump of the email server
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A forensic investigator needs to collect evidence from a public cloud VM that is co-located with other tenants on the same physical host. The investigator is concerned about the reliability of the evidence. Which challenge is most directly relevant?

   • AMulti-tenancy and potential data contamination
   • BLack of physical access to the server
   • CData volatility in memory
   • DJurisdictional issues across borders
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During an active cloud incident, the response team discovers that the compromised instance is part of an auto-scaling group. They need to preserve evidence while stopping the spread. Which sequence of actions best balances evidence preservation with containment?

   • ADetach the instance from the auto-scaling group, snapshot the disk, then shut down the instance.
   • BSnapshot the disk first, then terminate the instance, and rely on the auto-scaling group to launch a clean instance.
   • CTerminate the instance immediately to stop the attack, then collect logs from the cloud provider.
   • DPause the auto-scaling group, then take a memory dump from the instance, then snapshot the disk.
   Reveal Solution Discussion Select an answer first