Which Acquisition Type Fits a Cloud-Based Incident Investigation?
In a scenario where a potential security incident has occurred on a cloud-based service, and an investigator is brought in to examine the system, what type of data acquisition would likely be beneficial in this situation? Also, explain the volatile data type that might be most interesting to the investigator.
Community Votes
50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you can distinguish cloud-specific volatile evidence from generic live-acquisition artifacts; the trap is choosing the familiar open-files-and-command-history answer and ignoring the cloud context.
Cloud-based incident response calls for live acquisition to capture volatile artifacts, including cloud-service data and open unencrypted containers, before they are lost. This page explains why option C fits that scenario better than generic live acquisition or dead acquisition.
The common mistake is selecting A because open files and command history sound like classic volatile data, but that answer does not address cloud-service data or open unencrypted containers in the cloud incident described.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C is the best fit because it keeps the acquisition live and ties the volatile evidence to the cloud scenario: cloud-service data and unencrypted containers that are open on the examined system. In a cloud-based incident, live acquisition is needed before shutdown or session termination removes access to that dynamic state. The question also asks which volatile data type is most interesting, and C answers with cloud-resident data plus mounted or open container contents rather than generic local artifacts. This aligns with cloud forensics doctrine that stresses preserving rapidly changing, access-dependent evidence.Why the Other Options Are Wrong
Option A is a defensible live-acquisition description, but it is generic: open files and command history are classic volatile artifacts and do not address cloud-service data or open containers. Option B is wrong because dead acquisition after shutdown cannot capture volatile data such as open files, swap, or mounted container state. Option D is also wrong because unallocated disk space is non-volatile and a dead acquisition misses the live cloud session. The cloud wording in the stem is the differentiator that makes A less precise than C.Community Comment Notes
As 044f354 observed, Option C is the best fit for cloud-centric forensic cases where "data can vanish rapidly and must be captured in-session." That comment correctly prioritizes the cloud context over generic command-line artifacts. aqeel1506 argued that Option A offers a "comprehensive set of volatile data," including open files, command history, processes, and network connections, but those are generic live-acquisition artifacts rather than cloud-specific evidence. ala76nl simply noted "Command history," which supports A only as a single artifact and does not resolve the cloud-scenario requirement.Official Reference
Exam Strategy
When a question names a cloud service, eliminate dead acquisition immediately and then choose the live-acquisition option that mentions cloud-specific volatile artifacts. Do not stop at familiar generic volatile artifacts if a more scenario-specific option is available.
Frequently Asked Questions
Why is dead acquisition unsuitable for a cloud-based service incident?
Dead acquisition requires powering down the system, which destroys volatile cloud-session data and mounted container state before they can be captured.
Does option A still apply to local or hybrid cloud investigations?
Yes, open files and command history remain useful, but this question's cloud-service wording makes the cloud-specific volatile evidence in C the better match.