Foundational Cloud Concepts GEIR Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is moving from an IaaS-based application to a SaaS solution. The incident response team is concerned about their ability to collect forensic evidence. What is the most significant change they will face?

   • AThey will have less direct access to infrastructure-level logs and must rely on provider-provided audit and eDiscovery features
   • BThey will be able to install forensic agents on the underlying servers
   • CThey will have more access to the hypervisor and physical network
   • DThey will need to acquire memory dumps from the provider's data center
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When investigating an incident in a SaaS application, which forensic data is the cloud customer most likely to obtain directly?

   • ARaw disk images of the database
   • BApplication audit logs and user activity reports
   • CMemory dumps from the application server
   • DNetwork packet captures from the provider's internal network
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which virtualization component is responsible for isolating virtual machines from each other and managing their access to physical hardware?

   • AVirtual machine (VM)
   • BVirtual switch
   • CHypervisor
   • DHost operating system
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A forensic analyst is investigating a compromised VM in a virtualized environment. The VM has been suspended by the hypervisor. What is the most forensically sound next step?

   • ADelete the VM and restore from backup
   • BPower on the VM to collect volatile data from inside
   • CCopy the virtual disk file only
   • DTake a snapshot of the suspended VM to preserve its state, including memory
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During an incident in an IaaS environment, the IR team suspects that an attacker used a compromised API key to create a new administrative user. Which evidence source would most directly confirm the creation of the user and the API key used?

   • AThe virtual machine's system logs, which record login attempts to the guest OS
   • BThe cloud provider's management-plane audit logs, which record API calls including the authenticated principal and the action performed
   • CThe network flow logs from the virtual network, which show source and destination IP addresses
   • DThe application's database transaction logs, which record changes to application data
   Reveal Solution Discussion Select an answer first