A forensic investigator needs to collect memory from a compromised EC2 instance that is running a critical production workload. The instance does not have any forensic tools installed. Which approach is most appropriate for collecting memory evidence with minimal impact?

Take an EBS snapshot and analyze it for memory artifacts.

SSH into the instance and install a memory acquisition tool from the internet.

Use EC2 Instance Connect to run a built-in memory dump command.

Use AWS Systems Manager to run a memory acquisition tool that is staged in an S3 bucket.

Which of the following is a key component of the reporting phase in an AWS forensic investigation workflow?

Creating an EBS snapshot of the compromised instance

Documenting the chain of custody for evidence

Summarizing findings, evidence, and recommended remediation actions

Isolating the compromised instance from the network

GIAC Cloud Forensics Responder

Domain 4Objective 1

Understanding IR in AWS GCFR Practice Questions (Page 5)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

Questions 21–23

21foundation · easy
Which of the following is considered a volatile forensic artifact that should be collected from a running EC2 instance before it is stopped or terminated?
Select an answer first
22expert · hard
A forensic investigator needs to collect memory from a compromised EC2 instance that is running a critical production workload. The instance does not have any forensic tools installed. Which approach is most appropriate for collecting memory evidence with minimal impact?
Select an answer first
23foundation · easy
Which of the following is a key component of the reporting phase in an AWS forensic investigation workflow?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Understanding IR in AWS GCFR Practice Questions (Page 5)

Questions 21–23

Which of the following is considered a volatile forensic artifact that should be collected from a running EC2 instance before it is stopped or terminated?

A forensic investigator needs to collect memory from a compromised EC2 instance that is running a critical production workload. The instance does not have any forensic tools installed. Which approach is most appropriate for collecting memory evidence with minimal impact?

Which of the following is a key component of the reporting phase in an AWS forensic investigation workflow?

Keep studying — Amazon Web Services Forensics