Question

A SOC analyst is responding to an active compromise of a running IaaS virtual machine. Management wants to preserve evidence for a potential court case while the incident is ongoing. The VM is still powered on and the attacker appears to have an active session. Following forensic best practice and the order of volatility, what should the analyst prioritize acquiring FIRST?

Accepted Answer

The contents of the VM's live memory (RAM), including active network connections and running processes

Answer

A snapshot of the attached persistent block storage volume for later disk imaging

Answer

The cloud provider's monthly billing and metered-usage records for the affected account

Answer

The archived audit logs stored in the immutable long-term retention bucket