Support Digital Forensics CCSP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a PRIMARY reason to use a cloud provider's native snapshot feature for forensic collection rather than copying files from within the operating system?

   • ASnapshots are always stored in a separate region to ensure data sovereignty.
   • BSnapshots capture the entire disk state, including deleted files and metadata, at a consistent point in time.
   • CSnapshots are the only method that preserves the VM's memory contents.
   • DSnapshots do not require any access to the VM's operating system, so they avoid altering the evidence.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   During a forensic investigation in a cloud environment, which action is most important when collecting digital evidence from a virtual machine?

   • AReboot the VM to ensure the operating system is in a stable state
   • BCapture a snapshot of the VM's disk and memory while preserving metadata
   • CInstall forensic tools directly on the VM to analyze it in place
   • DDelete the VM immediately to prevent further tampering
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In cloud forensics, what is the purpose of hashing a forensic image immediately after collection?

   • ATo verify the integrity of the image and ensure it has not been altered during analysis.
   • BTo compress the image to reduce storage costs.
   • CTo index the image for faster searching during analysis.
   • DTo encrypt the image so that only authorized investigators can access it.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In cloud forensics, what is the primary purpose of hashing a piece of evidence at the time of collection?

   • ATo compress the evidence so that it takes up less storage space
   • BTo label the evidence with a timestamp for chain of custody purposes
   • CTo create a unique digital fingerprint that can later be used to verify the evidence has not changed
   • DTo encrypt the evidence so that it cannot be read by unauthorized parties
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In a cloud forensic investigation, which practice best supports the preservation of volatile evidence?

   • ACapturing memory and active network connections before powering off the instance
   • BDeleting the instance to prevent further changes to the evidence
   • CWaiting for the cloud provider to create a backup of the instance
   • DTaking a snapshot of the virtual disk after the instance is terminated
   Reveal Solution Discussion Select an answer first