A virtual machine hosted with an infrastructure cloud provider shows signs of compromise, and the incident response plan requires evidence to be preserved. What should responders do FIRST?
Select an answer to reveal the explanation.
Short Explanation
In the cloud, one click can make your evidence vanish forever. So you take the photograph first, a snapshot, then you put the machine in a locked room with network rules. Terminating feels like the cloud's version of pulling the plug, and it's just as destructive.
Full Explanation
Cloud environments make evidence easy to destroy: terminating an instance can permanently delete its storage and memory state. Preservation therefore comes first. Responders capture a snapshot of the attached disks and, where the platform and tooling allow, memory, recording hashes and metadata such as instance identifiers and time. They then isolate the machine by applying restrictive network rules that block inbound and outbound traffic except for investigative access, which contains the attacker without destroying evidence. Terminating the instance removes the attacker's foothold on that machine but also erases the evidence needed to determine how the compromise occurred and what was accessed. Restarting from the original template discards the malicious changes along with all forensic artefacts, and it may reintroduce the same vulnerability that was exploited. Asking the provider to delete the instance has the same evidence loss and also hands an organizational decision to a third party whose shared-responsibility role does not include running the customer's investigation. Exam caveat: cloud evidence handling should be planned in advance, including the access rights, tools and provider support needed, because improvising during an incident is slow. Operational check: confirm snapshot procedures are documented, tested and permitted by the organization's cloud access model.