An organization stores forensic evidence in an object storage bucket. The IR team needs to ensure that the evidence is preserved for a specific retention period and that no one, including administrators, can delete it before that period ends. Which configuration is most appropriate?

Copy the evidence to a different bucket and keep the original bucket private

Enable object lock with a retention mode that prevents deletion by all users, including the bucket owner, until the retention period expires

Enable versioning and rely on the bucket owner to avoid deleting old versions

Set the bucket to private and restrict delete permissions to a single administrator

An organization runs a critical application on a VM in an IaaS cloud. During an incident, the IR team needs to preserve the VM's memory for analysis. The cloud provider offers a snapshot feature, but the team is concerned about the forensic validity of the snapshot. What is the most appropriate action to preserve volatile evidence?

Use the provider's VM snapshot feature to capture the disk state, then separately acquire memory using a tool that runs inside the guest OS

Rely solely on the provider's snapshot, which includes both disk and memory in a single consistent image

Power off the VM immediately and then take a snapshot to ensure a clean forensic image

Copy the VM's virtual disk file directly from the underlying storage without using the snapshot API

An incident responder is investigating a suspected compromise in a cloud environment. Which management-plane activity is most likely to provide evidence of unauthorized administrative actions?

Reviewing the guest OS security event logs on the virtual machines

Reviewing the application logs of the web server

Reviewing the cloud provider's API call logs for the affected resources

Reviewing the network flow logs for traffic between VMs

A forensic analyst needs to preserve the memory of a running virtual machine during an incident. What is the most appropriate method?

Power off the VM and then copy the memory file

Use the hypervisor's snapshot feature to capture the VM's memory state

Copy the virtual disk file while the VM is running

Run a memory acquisition tool inside the guest OS

GIAC Enterprise Incident Responder

Domain 2Objective 1

Foundational Cloud Concepts GEIR Practice Questions (Page 6)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 26–30

26expert · hard
An organization stores forensic evidence in an object storage bucket. The IR team needs to ensure that the evidence is preserved for a specific retention period and that no one, including administrators, can delete it before that period ends. Which configuration is most appropriate?
Select an answer first
27foundation · easy
Which cloud deployment model is characterized by infrastructure that is shared by several organizations with common compliance or policy needs, but not open to the general public?
Select an answer first
28application · medium
An organization runs a critical application on a VM in an IaaS cloud. During an incident, the IR team needs to preserve the VM's memory for analysis. The cloud provider offers a snapshot feature, but the team is concerned about the forensic validity of the snapshot. What is the most appropriate action to preserve volatile evidence?
Select an answer first
29application · medium
An incident responder is investigating a suspected compromise in a cloud environment. Which management-plane activity is most likely to provide evidence of unauthorized administrative actions?
Select an answer first
30application · medium
A forensic analyst needs to preserve the memory of a running virtual machine during an incident. What is the most appropriate method?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Foundational Cloud Concepts GEIR Practice Questions (Page 6)

Questions 26–30

An organization stores forensic evidence in an object storage bucket. The IR team needs to ensure that the evidence is preserved for a specific retention period and that no one, including administrators, can delete it before that period ends. Which configuration is most appropriate?

Which cloud deployment model is characterized by infrastructure that is shared by several organizations with common compliance or policy needs, but not open to the general public?

An incident responder is investigating a suspected compromise in a cloud environment. Which management-plane activity is most likely to provide evidence of unauthorized administrative actions?

A forensic analyst needs to preserve the memory of a running virtual machine during an incident. What is the most appropriate method?

Keep studying — Cloud and Container Forensics