PCSE Practice Question: Managing Operations in a Cloud Solution Environment
During a forensic investigation, you need to analyze a Compute Engine instance that has been compromised. You want to preserve the disk state for analysis without affecting the running instance. Which action should you take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a snapshot of the persistent disk and attach the snapshot to a new instance for analysis.
Creating a snapshot is the non-disruptive, best practice for forensic preservation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the instance but keep the disk, then attach the disk to a new instance.
Why it's wrong here
Deleting the instance is not recommended as it may trigger cleanup actions.
- ✓
Create a snapshot of the persistent disk and attach the snapshot to a new instance for analysis.
Why this is correct
Snapshots capture the disk state at a point in time and can be used to create new disks attached to a forensic VM.
- ✗
Stop the instance and create a custom image from the boot disk.
Why it's wrong here
Stopping the instance may alter the state (e.g., memory loss). Snapshots are preferred for preservation.
- ✗
Use gcloud compute disks export to export the disk to Cloud Storage.
Why it's wrong here
Export is for image migration, not for preserving disk state for analysis.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.