PCSE Practice Question: Managing Operations in a Cloud Solution Environment
During a security incident, a forensics team needs to capture a disk snapshot of a compromised Compute Engine instance for analysis. They want to ensure the snapshot is consistent and includes data in memory. Which step should be taken before taking the snapshot?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stop the instance before taking the snapshot
For consistent snapshots of a running instance, you should first stop the instance (or at least freeze the filesystem). To capture memory, you would need to use a tool like LiME or dump the memory via a hypervisor; standard disk snapshots do not capture memory. However, the question asks about disk snapshot consistency; the best practice is to stop the instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Take a snapshot while the instance is running; consistency is automatic
Why it's wrong here
Running instance snapshots are crash-consistent only; for application-consistent snapshots, stop the instance or use a freeze mechanism.
- ✗
Enable VPC Flow Logs on the network
Why it's wrong here
VPC Flow Logs capture network metadata, not disk state or memory.
- ✓
Stop the instance before taking the snapshot
Why this is correct
Stopping the instance ensures the disk is in a consistent state; the snapshot will be crash-consistent. Memory is not captured.
- ✗
Create an image from the disk first
Why it's wrong here
An image is similar to a snapshot but does not capture memory; stopping the instance is still required for consistency.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.