Question

During an active intrusion on a Linux production VM in Google Cloud, a SecOps SOAR playbook is triggered to collect forensic evidence before containment. The incident lead wants the playbook to preserve data with the highest chance of loss first. Which evidence collection step should the playbook execute FIRST?

Accepted Answer

Capture the VM's volatile memory (RAM) contents from the running instance

Answer

Create a persistent disk snapshot of the boot and data disks

Answer

Export the VM's serial console logs to a Cloud Storage bucket

Answer

Pull the last 30 days of VPC Flow Logs for the instance from SecOps