Which part of the incident response process is greatly complicated by the resource pooling and rapid elasticity of cloud infrastructure?

Recovery is not primarily hindered by cloud elasticity - rapid elasticity actually aids recovery by enabling fast resource reprovisioning.

Ballistics is not a recognized standard phase of incident response and has no direct relationship to cloud infrastructure characteristics.

Detection can be challenging in cloud environments but is not specifically complicated by resource pooling and rapid elasticity in the same direct way forensic preservation is.

Forensics is greatly complicated by cloud characteristics because dynamically allocated and shared resources make it difficult to isolate specific data, maintain chain of custody, and preserve volatile evidence - resources may be reallocated or overwritten before investigators can collect them, and multi-tenancy means evidence may be commingled across customer environments.

Preparation is a planning phase completed before incidents occur and is not directly disrupted by cloud resource pooling or on-demand elasticity.