CCSP Memory acquisition Practice Question
During a cloud incident response, a security team needs to collect memory from a compromised EC2 instance for forensic analysis. Which method is most appropriate for acquiring a memory dump?
⚠ Common exam trap
CCSP often tests cloud forensic order of volatility, and candidates may pick EBS snapshots or logs because they are familiar AWS artifacts — the trap is forgetting that memory is volatile and cannot be captured from disk or API logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Systems Manager to run a memory acquisition script on the instance.
Memory acquisition on a running EC2 instance requires executing a tool on the instance itself, and AWS Systems Manager (SSM) Run Command allows the security team to run a memory acquisition script remotely without SSH access or opening inbound ports. This preserves the volatile memory contents while maintaining an auditable, IAM-controlled execution path. It is the most appropriate method for capturing RAM from a live instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Analyze CloudTrail logs for the instance's API calls.
Why it's wrong here
CloudTrail records control-plane API activity, not volatile memory contents, so it cannot yield a RAM image. It is tempting because CloudTrail is the primary EC2 forensic log source, but it suits auditing API calls and identifying the attacker's actions, not memory acquisition.
- ✗
Take a snapshot of the EBS volumes attached to the instance.
Why it's wrong here
An EBS snapshot captures block-level disk state, not the running kernel, processes or encryption keys held in RAM. It is tempting because snapshots are the standard EC2 forensic acquisition method for persistent storage, and would be correct if the requirement were filesystem artefacts rather than volatile memory.
- ✗
Review VPC Flow Logs for network traffic.
Why it's wrong here
VPC Flow Logs record IP metadata for traffic traversing elastic network interfaces, not volatile memory contents, so they cannot yield a RAM image. They are tempting because they support network forensics and exfiltration timelines, and would be the right artefact when the question asks how the attacker communicated rather than what ran in memory.
- ✓
Use AWS Systems Manager to run a memory acquisition script on the instance.
Why this is correct
AWS Systems Manager Run Command executes a memory acquisition script directly on the running EC2 instance, preserving volatile memory contents. This avoids rebooting or stopping the instance, which would destroy the RAM evidence needed for forensic analysis.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.