PCSE Practice Question: Managing Operations in a Cloud Solution Environment
A security analyst needs to investigate a potential breach in a Compute Engine instance. They want to create an offline forensic copy of the disk without affecting the running instance. Which action should they take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stop the instance and create a snapshot of the boot disk.
Creating a snapshot is the correct method to create a point-in-time copy of a persistent disk for forensic analysis. The snapshot can be used to create a new disk for analysis. Stopping or creating an image modifies the instance state or does not preserve all data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an image from the disk while the instance is running.
Why it's wrong here
Creating an image from a running disk may result in an inconsistent state, and images are used for creating new instances, not forensics.
- ✗
Use the gcloud compute disks copy command to replicate the disk.
Why it's wrong here
There is no disks copy command; you can create a snapshot or clone, but cloning requires stopping the instance.
- ✗
Attach a new blank disk to the instance and use dd to clone the data.
Why it's wrong here
Running dd on a live instance changes disk state and may contaminate evidence.
- ✓
Stop the instance and create a snapshot of the boot disk.
Why this is correct
Stopping ensures a consistent snapshot; the snapshot can be used for forensics without affecting the original instance.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.