hardMultiple ChoiceObjective-mapped
CCSP Practice Question: During a security incident in a multi-tenant…
During a security incident in a multi-tenant cloud environment, the cloud provider's logging system indicates that a virtual machine (VM) on a shared hypervisor has been compromised. The provider wants to assist the customer with forensic analysis while minimizing impact to other tenants. Which approach is most appropriate?
⚠ Common exam trap
ISC2 often tests the distinction between forensic acquisition (preserving evidence) and incident containment/remediation, where candidates mistakenly choose immediate power-off (Option D) or rebuild (Option A) instead of the correct memory snapshot approach that balances evidence preservation with multi-tenant isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Provide the customer with a memory snapshot of the compromised VM.
Providing a memory snapshot of the compromised VM preserves volatile forensic data (e.g., running processes, network connections, encryption keys) without disrupting the hypervisor or other tenants. This approach adheres to the cloud provider's responsibility to isolate forensic evidence while maintaining multi-tenant isolation, as memory snapshots can be taken via hypervisor-level APIs (e.g., VMware VMotion or libvirt) without powering off the VM or cloning the entire host. Option A is incorrect because rebuilding the VM from a known good image destroys the compromised state, overwriting volatile evidence that is critical for forensic analysis. Option C is incorrect because cloning the entire hypervisor introduces significant performance overhead and security risks to other tenants, potentially violating isolation boundaries. Option D is incorrect because powering off the VM immediately may cause loss of volatile memory data crucial for investigation, such as running processes and encryption keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rebuild the VM from a known good image and then run security scans.
Why it's wrong here
Rebuilding the VM from a known good image destroys the compromised state, overwriting volatile evidence that is critical for forensic analysis.
- ✓
Provide the customer with a memory snapshot of the compromised VM.
Why this is correct
Providing a memory snapshot of the compromised VM preserves volatile forensic data without disrupting the hypervisor or other tenants.
- ✗
Clone the entire hypervisor and give the customer access to the clone.
Why it's wrong here
Cloning the entire hypervisor introduces significant performance overhead and security risks to other tenants, potentially violating isolation boundaries.
- ✗
Power off the VM immediately to contain the incident.
Why it's wrong here
Powering off the VM immediately may cause loss of volatile memory data crucial for investigation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.