Certified Cloud Security Engineer (CCSE) — Question 5

Ray Nicholson works as a senior cloud security engineer in TerraCloud Sec Pvt. Ltd. His organization deployed all applications in a cloud environment in various virtual machines. Using IDS, Ray identified that an attacker compromised a particular VM. He would like to limit the scope of the incident and protect other resources in the cloud. If Ray turns off the VM, what will happen?

Answer options

• A. The data required to be investigated will be stored in the VHD
• B. The data required to be investigated will be saved
• C. The data required to be investigated will be recovered
• D. The data required to be investigated will be lost

Correct answer: A

Explanation

Turning off the VM ensures that the current state of the virtual hard disk (VHD) is preserved, allowing for forensic analysis later. Options B and C imply that the data is actively saved or recovered, which is not guaranteed just by shutting down the VM. Option D is incorrect because the data won't be lost if the VM is simply powered off.