PCSE Practice Question: Managing Operations in a Cloud Solution Environment
During a security incident, a forensic investigator needs to analyze a compromised Compute Engine instance without affecting the live environment. The instance has persistent disks with critical data. What is the best first step to preserve evidence?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a snapshot of the persistent disks.
Creating a snapshot of the persistent disks preserves a point-in-time copy without affecting the running instance. The snapshot can then be used to create a new disk attached to a forensic VM for analysis. Disk cloning requires stopping the instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Clone the instance to a new VM.
Why it's wrong here
Cloning may alter the source instance or require downtime.
- ✗
Export the disk image to Cloud Storage.
Why it's wrong here
Exporting a disk image to Cloud Storage creates a static copy, but this action still requires the instance to be stopped or the disk to be detached, which alters the live environment and risks losing volatile evidence such as running processes or memory contents. This step is tempting because it is a standard forensic preservation technique for persistent data, and would be correct if the goal were solely to archive the disk contents for offline analysis after the live environment had already been secured.
- ✗
Enable VPC Flow Logs for the instance's network.
Why it's wrong here
Flow logs are for network analysis, not disk evidence preservation.
- ✓
Create a snapshot of the persistent disks.
Why this is correct
Snapshot preserves data without downtime.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.