CCSE CCSE Incident Response & Forensics in Cloud 3

Question 1

Which tool is commonly used for memory forensics analysis of cloud VM snapshots?

Accepted Answer

Volatility Framework

Answer

The Volatility Framework is an open-source memory forensics tool used to analyze RAM dumps for processes, network connections, and malware artifacts.

Question 2

During a cloud incident, an analyst notices unauthorized API calls originating from a legitimate service account. This is most likely an example of:

Accepted Answer

Credential compromise or token hijacking

Answer

When legitimate credentials produce unauthorized actions, it typically indicates the credentials have been stolen or an access token has been hijacked.

Question 3

What is 'cloud evidence spoliation' and why is it a concern for incident responders?

Accepted Answer

Accidental or intentional destruction of evidence due to cloud resource deletion or log expiration

Answer

Cloud resources and logs can be automatically deleted or overwritten, destroying forensic evidence before it can be collected if not preserved promptly.

Question 4

Which GCP service provides audit logs that record admin activity and data access for forensic investigation?

Accepted Answer

Cloud Audit Logs (Cloud Logging)

Answer

GCP Cloud Audit Logs capture admin activity, data access, and system events across GCP services, forming the basis for forensic investigation.

Question 5

An organization's cloud incident response plan should define RTO and RPO. What does RPO stand for?

Accepted Answer

Recovery Point Objective

Answer

Recovery Point Objective (RPO) defines the maximum acceptable data loss measured in time, determining how frequently backups must be taken.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE CCSE Incident Response & Forensics in Cloud 3