CHFI Application, Email and Cloud Forensics Practice Question
In the context of cloud forensics, what is the primary challenge associated with volatile evidence in Infrastructure as a Service (IaaS) environments?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Evidence can be lost when the cloud instance is stopped or terminated
Volatile evidence such as memory and running processes disappears when an instance is stopped or terminated, making timely acquisition critical.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Evidence can be lost when the cloud instance is stopped or terminated
Why this is correct
Stopping or terminating a cloud instance clears volatile memory (RAM), which contains running processes, open network connections, kernel objects, and other live forensic evidence that exists only while the OS is executing. Unlike persistent block storage, this in-memory state is not captured by ordinary disk snapshots, and recovery becomes impossible once the hypervisor reclaims the memory pages. Therefore, forensic investigators must acquire memory before shutdown using live acquisition techniques or pre-configured collection mechanisms, making this the primary volatility-specific challenge.
- ✗
Evidence may be stored across multiple jurisdictions
Why it's wrong here
Multi-jurisdictional storage means data may reside in servers located in different countries, triggering overlapping legal frameworks, data protection laws, and mutual legal assistance treaties. This complicates warrant execution and chain-of-custody but does not relate to the ephemeral nature of evidence that disappears when a machine is powered off. It is a legal and geographic problem rather than a technical property of volatile memory, so it is not the central volatility concern.
- ✗
Encryption of data at rest prevents access to evidence
Why it's wrong here
Encryption of data at rest protects persistent storage such as cloud volumes and object storage, making forensic acquisition difficult when encryption keys are unavailable, since the data is ciphertext. However, while an instance is running, memory contents are generally decrypted and accessible in RAM, and the encryption itself does not cause evidence to vanish on shutdown. This is a confidentiality and access barrier, distinct from the volatility-driven loss of transient state, and therefore not the primary challenge.
- ✗
Cloud providers may not allow forensic investigators to access the physical hardware
Why it's wrong here
Cloud providers often restrict forensic examiners from physically handling servers because infrastructure is shared among tenants and controlled by the provider, so investigators must rely on logical acquisition through APIs or snapshot services. This limited hardware access is a significant general constraint in cloud forensics, impacting evidence reliability and tool compatibility, but it is about physical media access rather than the transient survival of live memory content. It remains a separate obstacle unrelated to the loss of volatile data upon instance termination.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.