Foundational Cloud Concepts GEIR Practice Questions (Page 10)

Questions 46–49

1. 46foundation · easy

   When acquiring forensic evidence from a virtual machine, why might a responder prefer to use a snapshot rather than a live acquisition?

   • ASnapshots capture the exact state of the VM at a point in time without altering the running system
   • BSnapshots include the hypervisor memory
   • CSnapshots are always smaller than memory dumps
   • DSnapshots are automatically encrypted
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security analyst needs to detect a potential data exfiltration from a cloud environment. Which logging source would be most useful for identifying large outbound data transfers?

   • ACloud provider's billing records
   • BGuest OS authentication logs
   • CApplication performance monitoring logs
   • DVirtual network flow logs that record bytes transferred per connection
   Reveal Solution Discussion Select an answer first
4. 48expert · hard · select all that apply

   An organization uses a hybrid cloud environment. During an incident, the IR team needs to collect evidence from both on-premises and cloud resources. Which of the following are appropriate evidence sources? (Select all that apply.)

   • ACloud management-plane audit logs that show API calls
   • BOn-premises identity provider logs that show authentication events
   • COn-premises firewall logs that show traffic to and from the cloud
   • DCloud provider's physical server logs
   • ECloud virtual machine system logs
   Check answers Discussion Select an answer first
5. 49application · medium

   An organization uses a cloud IAM system with role-based access control. During an incident, the IR team needs to determine which roles were assigned to a compromised user account and what actions those roles permit. Which evidence source is most relevant?

   • AThe network access control lists, which show allowed traffic to the user's resources
   • BThe cloud provider's billing records, which show resource usage by the user
   • CThe virtual machine's security event logs, which show local user logins
   • DThe IAM policy and role assignment logs, which show the roles attached to the user and the permissions granted
   Reveal Solution Discussion Select an answer first