Microsoft Azure Virtual Machines GCFR Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A forensic team is responding to an incident on a Linux Azure VM. They need to collect volatile memory data, but the VM has the Azure Monitor Agent installed and the team has only Reader access to the VM resource. The team also has a custom script that can capture memory if executed. What is the most practical way to execute the memory capture?

   • AAsk the VM owner to run the script manually via SSH.
   • BUse the Azure Serial Console to run the script as root.
   • CUse a VM extension to run the custom script.
   • DUse Azure Monitor to trigger the script based on a metric alert.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is investigating a compromised Azure VM and needs to determine which external IP addresses attempted to connect to the VM over the past 30 days. The VM has a public IP and is protected by an NSG. What is the most efficient way to retrieve this historical connection data?

   • AReview the VM's network interface metrics in Azure Monitor.
   • BEnable NSG flow logs and query the Log Analytics workspace for the relevant time period.
   • CCheck the Azure Activity Log for network security events.
   • DUse the VM's built-in firewall logs from the guest OS.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security operations center is investigating a suspected privilege escalation on an Azure VM. The VM has the Azure Monitor Agent installed and is sending logs to a Log Analytics workspace. The team needs to determine if a specific user account was created or modified on the VM. Which log source should they query first?

   • AAzure Activity Log for VM write operations.
   • BBoot Diagnostics logs for the VM.
   • CNSG flow logs for the VM's network interface.
   • DSecurity events from the VM's guest OS, collected by the Azure Monitor Agent.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An incident responder needs to collect forensic data from an Azure VM that is not accessible via the network. The VM is stopped (deallocated). Which method should be used to collect data from the OS disk?

   • AAttach the OS disk to another VM directly.
   • BStart the VM and use the Azure portal to download the VHD.
   • CCreate a snapshot of the OS disk, create a new VM from the snapshot, and then collect data from that VM.
   • DUse Azure Backup to restore the VM to a new VM.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An organization is responding to a security incident involving an Azure VM. The VM has an OS disk and a separate data disk. The investigator needs to preserve evidence from both disks, but the VM is currently running a critical application that cannot be stopped. The investigator also needs to ensure that the evidence is admissible in court. What is the best approach?

   • AStop the VM, copy the VHDs to a storage account, and then restart the VM.
   • BAttach a new data disk to the VM and copy the contents of the OS and data disks to it.
   • CUse Azure Backup to back up the VM and then restore the backup to a new VM for analysis.
   • DCreate snapshots of both disks, then create new managed disks from the snapshots and attach them to a forensic analysis VM.
   Reveal Solution Discussion Select an answer first