Resource pooling practiced by the cloud services may especially complicate which part of the IR process?

Detection of incidents relies on logs and alerts generated at the logical layer and is not uniquely hindered by the physical sharing of resources among tenants.

Prevention controls such as access policies and firewalls operate at the logical layer and are not specifically complicated by the physical resource pooling model.

Monitoring captures events at the logical and application layers and is not inherently more difficult because the underlying hardware is shared across tenants.

Recovery can actually benefit from resource pooling because cloud elasticity allows rapid redeployment of resources, and pooling does not specifically impede restoring systems to a known-good state.

Resource pooling means physical storage and compute are dynamically shared and reallocated among multiple tenants, so when an incident occurs the underlying hardware may contain data from many parties or may already have been reallocated and overwritten before investigators can act. Establishing a proper chain of custody is extremely difficult, and cloud tenants typically lack direct access to the physical media needed for low-level evidence acquisition. These factors make collecting, preserving, and analyzing forensic artifacts far more challenging in pooled cloud environments than in traditional dedicated infrastructure.