CCSE Incident Response & Forensics in Cloud Flashcards

Which tool is commonly used for memory forensics analysis of cloud VM snapshots?

Answer: Volatility Framework

The Volatility Framework is an open-source memory forensics tool used to analyze RAM dumps for processes, network connections, and malware artifacts.

During a cloud incident, an analyst notices unauthorized API calls originating from a legitimate service account. This is most likely an example of:

Answer: Credential compromise or token hijacking

When legitimate credentials produce unauthorized actions, it typically indicates the credentials have been stolen or an access token has been hijacked.

What is 'cloud evidence spoliation' and why is it a concern for incident responders?

Answer: Accidental or intentional destruction of evidence due to cloud resource deletion or log expiration

Cloud resources and logs can be automatically deleted or overwritten, destroying forensic evidence before it can be collected if not preserved promptly.

Which GCP service provides audit logs that record admin activity and data access for forensic investigation?

Answer: Cloud Audit Logs (Cloud Logging)

GCP Cloud Audit Logs capture admin activity, data access, and system events across GCP services, forming the basis for forensic investigation.

An organization's cloud incident response plan should define RTO and RPO. What does RPO stand for?

Answer: Recovery Point Objective

Recovery Point Objective (RPO) defines the maximum acceptable data loss measured in time, determining how frequently backups must be taken.

Which approach helps ensure forensic soundness when acquiring disk images from cloud storage volumes?

Answer: Creating a snapshot and computing cryptographic hashes before and after acquisition

Computing cryptographic hashes (e.g., MD5/SHA-256) before and after acquisition verifies that the forensic copy is identical to the original evidence.