CCSE Incident Response & Forensics in Cloud Flashcards

Which of the following is a key consideration when collecting volatile evidence from a running cloud virtual machine?

Answer: Capture memory contents before any other action

Memory is volatile and lost on shutdown, so capturing RAM contents first preserves running processes, network connections, and encryption keys.

A cloud incident responder needs to preserve the state of a compromised EC2 instance. What is the best first step?

Answer: Create an AMI snapshot of the instance

Creating an AMI snapshot preserves the disk state of the compromised instance for forensic analysis without altering evidence.

Which NIST framework phase occurs immediately after containment during incident response?

Answer: Eradication

According to NIST SP 800-61, eradication follows containment and involves removing the root cause of the incident from the environment.

What is the purpose of a post-incident review (PIR) in cloud security?

Answer: To identify lessons learned and improve future response capabilities

A PIR analyzes what happened, why it happened, and how to improve detection, response, and prevention for future incidents.

In Azure, which service provides centralized security event collection and correlation for incident investigation?

Answer: Azure Sentinel (Microsoft Sentinel)

Microsoft Sentinel is Azure's cloud-native SIEM that collects, correlates, and analyzes security events across the environment.

When conducting cloud forensics across multiple regions, investigators must account for which legal consideration?

Answer: Data sovereignty and jurisdictional laws governing data in each region

Different geographic regions have different laws about data access, privacy, and cross-border transfer that can affect forensic investigations.