300-215 Question 56
Select 3While investigating a potential security breach in a virtualized environment hosted by a major cloud provider, you encounter challenges in obtaining forensic evidence. Which of the following are issues commonly associated with gathering evidence in such environments?
- A
Limited access to underlying hypervisor logs controlled by the cloud provider
- B
Inability to capture memory dumps from virtual machines in real-time without provider assistance
- C
Lack of encryption for stored data in cloud environments
- D
Data co-mingling on shared physical storage devices used by multiple tenants
- E
Availability of pre-built forensic toolkits from the cloud provider
Show answer and explanation
Correct answers: A, B, D
Explanation
Gathering evidence from virtualized environments hosted by major cloud providers comes with unique challenges, including limited access to hypervisor logs, difficulty in capturing real-time memory dumps, and the complexities of data co-mingling on shared storage devices. These issues stem from the shared responsibility model of cloud environments and the need to ensure tenant isolation and data security.
- A. Correct.
Cloud providers often restrict access to hypervisor logs to maintain the security and integrity of their multi-tenant environments, making it difficult for investigators to gather such evidence independently.
- B. Correct.
Capturing memory dumps in real-time from virtual machines often requires specialized tools or direct cooperation from the cloud provider, which can delay investigations.
- C. Incorrect.
Most major cloud providers ensure that stored data is encrypted by default; therefore, lack of encryption is generally not an issue during forensic investigations.
- D. Correct.
In shared physical storage environments, data from multiple tenants can reside on the same hardware, raising challenges in isolating and attributing specific data to an incident.
- E. Incorrect.
While some cloud providers offer forensic tools, their availability does not constitute an issue related to evidence gathering; rather, it can facilitate the process.