Free Preparation Discussions
MENU
Eccouncil 312-40 Exam - Topic 10 Question 28 Discussion
Topic #: 10
Ray Nicholson works as a senior cloud security engineer in TerraCloud Sec Pvt. Ltd. His organization deployed all applications in a cloud environment in various virtual machines. Using IDS, Ray identified that an attacker compromised a particular VM. He would like to limit the scope of the incident and protect other resources in the cloud. If Ray turns off the VM, what will happen?
When Ray Nicholson, the senior cloud security engineer, identifies that an attacker has compromised a particular virtual machine (VM) using an Intrusion Detection System (IDS), his priority is to limit the scope of the incident and protect other resources in the cloud environment. Turning off the compromised VM may seem like an immediate protective action, but it has significant implications:
Shutdown Impact: When a VM is turned off, its current state and all volatile data in the RAM are lost. This includes any data that might be crucial for forensic analysis, such as the attacker's tools and running processes.
Forensic Data Loss: Critical evidence needed for a thorough investigation, such as memory dumps, active network connections, and ephemeral data, will no longer be accessible.
Data Persistence: While some data is stored in the Virtual Hard Disk (VHD), not all of the forensic data can be retrieved from the disk image alone. Live analysis often provides insights that cannot be captured from static data.
Thus, by turning off the VM, Ray risks losing essential forensic data that is necessary for a complete investigation into the incident.
NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
AWS Cloud Security Best Practices
Azure Security Documentation
Luis
5 months agoMi
5 months agoLeatha
6 months agoCurtis
6 months agoChara
6 months agoTracie
6 months agoElroy
6 months agoJackie
7 months agoHarris
7 months agoKati
7 months agoTiffiny
7 months agoDesmond
7 months agoHelaine
8 months agoStefany
8 months agoCherry
11 months agoColeen
10 months agoCarrol
11 months agoMartina
11 months agoCharisse
11 months agoNarcisa
11 months agoAnglea
11 months agoRolande
11 months agoMinna
12 months agoRocco
11 months agoKarol
11 months agoVal
11 months agoRachael
12 months agoBerry
12 months agoOmer
12 months agoNichelle
12 months agoTabetha
1 year agoKarl
1 year agoWilliam
1 year agoVonda
1 year agoArdella
11 months agoRocco
12 months agoGlenn
12 months ago