300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

Question

DRAG DROP -

Drag and drop the cloud characteristic from the left onto the challenges presented for gathering evidence on the right.

Select and Place:

Question Image

Drag & Drop

broad network access

rapid Elasticity

measured service

resource pooling

application details are unavailable to investigators since being deemed private and confidential

obtaining evidence from the cloud service provider

circumvention of virtual machine isolation techniques via code or bad actor

evidence correlation across one or more cloud providers

Explanation

Measured service can limit investigators’ access to private cloud application implementation details. Resource pooling creates multi-tenant virtualized environments, so a VM-isolation escape can affect the hypervisor or other guest VMs. Rapid elasticity and distributed provider use make cross-provider artifact correlation difficult. Broad network access makes evidence acquisition dependent on remotely accessible provider-controlled systems.

Learn more

NISTIR 8006: NIST Cloud Computing Forensic Science Challenges

300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

AstroTutor

Notes

Readiness

QuestionQ42

Community Discussion