CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Multi-tenancy

  Why it's wrong here

  Multi-tenancy in cloud computing means multiple customers share the same physical hardware, virtual machines, or storage pools. While this creates forensic challenges such as isolating one tenant's data from another and preventing cross-contamination during acquisition, it is fundamentally a resource-sharing architectural issue, not the legal or geographic boundary problem that defines the major challenge in cloud forensics. The question emphasizes where data resides, which is jurisdiction-specific, not tenancy-specific.

• ✗

  Chain of custody

  Why it's wrong here

  Chain of custody refers to the documented, chronological record of evidence handling, including who collected, possessed, and accessed the evidence. Although cloud environments complicate this because evidence may traverse multiple administrative domains and cloud providers, the concept is a universal forensic procedure rather than a unique challenge caused by data's legal placement across borders. Thus, it is not the major challenge highlighted, as the core issue is jurisdictional authority, not documentation.

• ✗

  Volatile evidence

  Why it's wrong here

  Volatile evidence encompasses data that disappears when a system powers down, such as RAM contents, network connections, and running processes. In cloud forensics, investigators may indeed struggle to capture ephemeral data before it is lost or overwritten, but this is a temporal acquisition challenge, not a matter of which country's laws govern the stored data. The stem's reference to data jurisdiction is about legal boundaries, not data volatility.

• ✓

  Data jurisdiction

  Why this is correct

  Data jurisdiction is the correct answer because cloud providers routinely replicate and store customer data across multiple geographic regions and legal jurisdictions, often without precise knowledge of the physical location at a given moment. This forces investigators to navigate conflicting national laws, data sovereignty rules, and international legal assistance processes—unlike traditional on-premises forensics where location is fixed. Legal authority to access data may depend on the data's physical or controlling jurisdiction, making this the central challenge in cloud forensics.

Go deeper

Related to this question