CCSP Cloud Security Operations Practice Question
During incident response in a cloud environment, a team needs to collect evidence from a compromised EC2 instance without altering the system. Which of the following is the best method to obtain a forensic memory dump?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the AWS CLI to execute a memory dump script on the instance (e.g., via AWS Systems Manager Run Command)
To obtain a forensic memory dump from a compromised EC2 instance without rebooting or altering the disk state, you can use the AWS CLI to invoke a command that runs a memory acquisition tool, such as LiME or AVML. For example, you could send a command via AWS Systems Manager Run Command to dump memory to an S3 bucket for analysis. Options A and D capture non-volatile disk states (AMI and EBS snapshot), and Option B is unrelated to evidence collection. Therefore, Option C is the best choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an AMI of the instance
Why it's wrong here
Creating an AMI captures the disk state (EBS snapshots) and instance metadata, not the volatile memory.
- ✗
Enable detailed billing reports
Why it's wrong here
Detailed billing reports are financial records and contain no forensic evidence from the instance.
- ✓
Use the AWS CLI to execute a memory dump script on the instance (e.g., via AWS Systems Manager Run Command)
Why this is correct
This option directly involves obtaining a memory dump. Although the CLI command is not standard, it represents the correct intent to capture RAM.
- ✗
Take a snapshot of the root EBS volume
Why it's wrong here
While an EBS snapshot preserves disk data, it does not capture memory contents, which are volatile and lost when the instance is stopped.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.