Which Acquisition Type Fits a Cloud-Based Incident Investigation?

312-49v10 By islever Editorial Last updated

Cloud Forensics Data Acquisition and Duplication

Short answer

C Live acquisition captures volatile cloud-service data and open unencrypted containers before they disappear in a cloud incident.

Question

In a scenario where a potential security incident has occurred on a cloud-based service, and an investigator is brought in to examine the system, what type of data acquisition would likely be beneficial in this situation? Also, explain the volatile data type that might be most interesting to the investigator.
  1. Live acquisition should be employed to gather dynamic data from the system, concentrating on open files and command history
  2. Dead acquisition should be used to collect static data from the system, focusing on slack space and swap files
  3. Live acquisition would be advantageous to acquire volatile data, emphasizing data stored on cloud services and unencrypted containers that arc open on the system Correct Answer
  4. Dead acquisition should be utilized to capture non-volatile data from the physical hard disk, focusing on unallocated drive space

Key Takeaways

The question tests whether you can distinguish cloud-specific volatile evidence from generic live-acquisition artifacts; the trap is choosing the familiar open-files-and-command-history answer and ignoring the cloud context.

Cloud-based incident response calls for live acquisition to capture volatile artifacts, including cloud-service data and open unencrypted containers, before they are lost. This page explains why option C fits that scenario better than generic live acquisition or dead acquisition.

Common mistake: The common mistake is selecting A because open files and command history sound like classic volatile data, but that answer does not address cloud-service data or open unencrypted containers in the cloud incident described.

Expert Analysis

Why the Answer Is Correct

Option C is the best fit because it keeps the acquisition live and ties the volatile evidence to the cloud scenario: cloud-service data and unencrypted containers that are open on the examined system. In a cloud-based incident, live acquisition is needed before shutdown or session termination removes access to that dynamic state. The question also asks which volatile data type is most interesting, and C answers with cloud-resident data plus mounted or open container contents rather than generic local artifacts. This aligns with cloud forensics doctrine that stresses preserving rapidly changing, access-dependent evidence.

Why the Other Options Are Wrong

Option A is a defensible live-acquisition description, but it is generic: open files and command history are classic volatile artifacts and do not address cloud-service data or open containers. Option B is wrong because dead acquisition after shutdown cannot capture volatile data such as open files, swap, or mounted container state. Option D is also wrong because unallocated disk space is non-volatile and a dead acquisition misses the live cloud session. The cloud wording in the stem is the differentiator that makes A less precise than C.

Community Comment Notes

As 044f354 observed, Option C is the best fit for cloud-centric forensic cases where "data can vanish rapidly and must be captured in-session." That comment correctly prioritizes the cloud context over generic command-line artifacts. aqeel1506 argued that Option A offers a "comprehensive set of volatile data," including open files, command history, processes, and network connections, but those are generic live-acquisition artifacts rather than cloud-specific evidence. ala76nl simply noted "Command history," which supports A only as a single artifact and does not resolve the cloud-scenario requirement.

Official Reference

https://csrc.nist.gov/pubs/sp/800/86/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question names a cloud service, eliminate dead acquisition immediately and then choose the live-acquisition option that mentions cloud-specific volatile artifacts. Do not stop at familiar generic volatile artifacts if a more scenario-specific option is available.

Frequently Asked Questions

Why is dead acquisition unsuitable for a cloud-based service incident?

Dead acquisition requires powering down the system, which destroys volatile cloud-session data and mounted container state before they can be captured.

Does option A still apply to local or hybrid cloud investigations?

Yes, open files and command history remain useful, but this question's cloud-service wording makes the cloud-specific volatile evidence in C the better match.

More 312-49v10 FAQ →

Community Votes

A
50%
C
50%

50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. aqeel1506 👍 1
    Why Option A is Better: Option A emphasizes gathering a comprehensive set of volatile data, including: Open Files: Crucial for understanding what data was in use at the time of the incident. Command History: Provides insight into what actions were taken by the user or attacker. Running Processes and Network Connections: Helps in identifying active threats or compromised components. Option C is somewhat narrow in its focus. While it includes important elements like data stored on cloud services and unencrypted containers, it might overlook other critical volatile data that live acquisition should cover comprehensively.
  2. 044f354 👍 1 Answered C
    Option A is very useful for tracking command-line behavior and attacker intent, especially on local or hybrid systems. Option C is the best fit for cloud-centric forensic cases, where data can vanish rapidly and must be captured in-session. Both are valid in different contexts — but for a cloud-based incident, Option C offers the most complete coverage of volatile evidence critical to the case. - If you agree: UPVOTE this post to add your vote to the community tally. If you disagree: discuss with citations Both actions crowdsource best answers.
  3. ala76nl 👍 1 Answered A
    Command history

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Analyzing Password-Protected Packed Malware

S-grade

Steganalysis for Steganography Attack Detection

S-grade

File Sector Allocation and Fragmentation in Forensics

S-grade

Which Tor Relay Should Investigators Focus On to Trace Data Origin?

S-grade

← Back to 312-49v10 Study Guide