CHFI Network and Cloud Forensics Practice Question
You are a forensic investigator responding to a data breach at a mid-sized company. The company uses a hybrid cloud environment with AWS for production workloads and on-premises servers for legacy applications. The breach was detected when an internal monitoring system flagged unusual outbound traffic from an AWS EC2 instance (i-0a1b2c3d4e5f) to an external IP address (198.51.100.20) on TCP port 4444 during off-hours. The EC2 instance runs a Linux-based web server. The security team has already isolated the instance by removing its security group rules and stopping the instance. You have been provided with the following: (1) AWS CloudTrail logs for the past 72 hours, (2) VPC Flow Logs for the same period, (3) a snapshot of the instance’s root volume (EBS), and (4) the instance metadata log from the AWS console. The company’s incident response policy requires preservation of all volatile data before powering off the instance. Which of the following steps should you take FIRST to ensure a forensically sound investigation?
⚠ Common exam trap
Candidates often confuse volatile data preservation with the need to acquire memory from a stopped instance (Option A), not realizing that stopping the instance already destroys RAM, and the snapshot only captures disk data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a forensic copy of the EBS snapshot and attach it to a separate analysis EC2 instance in a different AWS account to avoid altering evidence.
The first step in a forensically sound investigation is to create a forensic copy (bit-for-bit) of the EBS snapshot before any analysis. This preserves the original evidence integrity, as required by the order of volatility and chain of custody. Attaching the copy to a separate analysis EC2 instance in a different AWS account prevents accidental modification of the original snapshot and isolates the forensic environment from the compromised production account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Acquire a memory dump from the stopped instance by re-attaching the root volume to a forensic workstation.
Why it's wrong here
Stopping an Amazon EC2 instance issues an ACPI shutdown to the guest OS, which powers off the system and immediately destroys all volatile memory contents; there is no mechanism to persist RAM to disk during a normal stop. Re-attaching the root volume to a forensic workstation only exposes the non-volatile block devices, never the memory that existed before shutdown. Therefore, a memory dump from a stopped instance is impossible to acquire after the fact, and this action does not preserve any evidence.
- ✗
Review the instance metadata log to identify the user who launched the instance.
Why it's wrong here
Instance metadata accessible via the EC2 metadata endpoint (169.254.169.254) describes configuration attributes like instance ID, AMI, and user-data; it does not contain a 'metadata log' of who launched the instance. User identity for the RunInstances call is recorded in AWS CloudTrail, which is a separate control-plane audit log. Moreover, reviewing metadata or CloudTrail is an analysis step that can be done after the EBS snapshot is preserved, so doing it first wastes time while the sole disk evidence remains at risk in the compromised account.
- ✓
Create a forensic copy of the EBS snapshot and attach it to a separate analysis EC2 instance in a different AWS account to avoid altering evidence.
Why this is correct
Creating a forensic copy of the EBS snapshot and attaching that copy to a separate EC2 instance in a different AWS account is the correct first preservation step because the snapshot is the only durable disk evidence of the compromised instance. Attaching the original snapshot to an analysis instance—even read-only—risks unwitting writes from filesystem journal replay, and operating in the same account risks accidental modification or deletion. A copied snapshot in an isolated account grants a clean, authority-controlled workspace where forensic tools cannot alter the original evidence.
- ✗
Analyze the VPC Flow Logs to determine if other instances communicated with the same external IP.
Why it's wrong here
VPC Flow Logs record network traffic metadata (IP addresses, ports, protocols) and are stored independently in S3 or CloudWatch Logs, so reading them will not disturb disk evidence. However, analyzing them to hunt for other instances talking to the external IP is a reactive analysis step, not an evidence-preservation step; it does not secure the EBS snapshot, which is the only disk artifact of the breached instance. If the account is still live, the snapshot could be tampered with or lost while the investigator spends time correlating historical network flows.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
Chain of custody
Chain of custody is a documented process that tracks the handling, transfer, and possession of evidence or digital assets from the moment they are collected until they are presented in court or used in an investigation.
Key term
Process Memory Dump
A process memory dump is a snapshot of all the data a specific running program has stored in RAM at a single moment, used for analyzing its behavior and contents.
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.