CCSP - Cloud Security Operations (17% of the exam) - Section 5.4
Support digital forensics.
Forensic data collection methodologies, evidence management, and collection, acquisition and preservation of digital evidence in a multi-tenant environment where physical seizure is not possible.
forensic data collectionevidence managementchain of custodyISO/IEC 27037ISO/IEC 27050
Practice question for this objective
lock_openFree sampleCloud Security Operationshard
A healthcare SaaS provider hosts patient records classified as sensitive. A hospital customer's legal team issues a preservation request for one tenant's data ahead of litigation. The provider operates a shared multi-tenant database. Which action BEST satisfies the forensic preservation obligation without breaching other tenants' data?
AExport a full snapshot of the shared database and hand it to the requesting customer's legal team
BPlace a scoped legal hold that preserves only the requesting tenant's records and associated logs in an immutable storecheck_circle Correct
CSuspend routine data-retention purges across the entire platform until the litigation concludes
DEncrypt the requesting tenant's records with a customer-held key so they cannot be modified
Preservation in multi-tenant cloud forensics requires a tenant-scoped, immutable legal hold that isolates relevant data without exposing other tenants. A legal hold suspends normal deletion for the specific custodian data and, when combined with immutable storage, prevents spoliation while tenant scoping keeps the collection lawful and confidential in a shared environment.
Why A is wrong: A full snapshot would preserve the data, but it commingles every tenant's records, so disclosing it breaches confidentiality obligations to the other tenants and exceeds the scope of the request.
Why B is correct: Correct: a tenant-scoped legal hold isolates the relevant custodian data, preserves it against alteration or routine deletion, and avoids exposing or collecting other tenants' records in a shared platform.
Why C is wrong: Halting all purges does prevent spoliation, but applying it platform-wide is disproportionate, inflates storage and privacy risk for unrelated tenants, and is not the scoped response the situation requires.
Why D is wrong: Encryption protects confidentiality but does not prevent deletion or overwriting, so it fails the preservation goal, which requires immutability and a hold against routine purges rather than key control.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
The customer directly acquires hypervisor logs and host memory because IaaS grants full-stack access
errorWhy it is wrong: IaaS gives more control than PaaS, but it stops at the guest boundary, so assuming direct access to hypervisor logs and host memory misreads the model and is technically impossible for the tenant.
Take a cloud-provider snapshot of the attached persistent volumes and record the snapshot identifiers
errorWhy it is wrong: Snapshotting persistent storage is a valid acquisition step, but disk data is non-volatile relative to memory, so doing this first risks losing running-process and network-connection evidence that disappears the moment the instance stops.
Store the images in a shared cloud bucket and grant read access to everyone who may need to examine them
errorWhy it is wrong: Broad shared access speeds collaboration, but it creates many uncontrolled handlers and no transfer record, which undermines rather than documents custody and invites tampering claims.