A forensic investigator needs to preserve the state of an Azure VM's data disk for legal hold. The VM is currently running a production workload. The investigator wants to ensure the data disk is preserved without affecting the running VM. What should the investigator do?

Create a snapshot of the data disk.

Attach the data disk to another VM to copy it.

Use Azure Site Recovery to replicate the VM.

Stop the VM and copy the data disk to a storage account.

A security team needs to collect memory and disk forensics from a running Azure VM without stopping it. The VM is Windows-based and the team has Contributor access to the VM. Which approach should they use?

Create a snapshot of the VM's memory from the Azure portal.

Use the Azure Serial Console to run a memory dump command.

Deploy the Azure Monitor Agent with the VM Insights solution and use the collected performance data.

Install a third-party agent-based collection tool that supports live memory acquisition.

A forensic analyst is examining an Azure VM that was part of an availability set. The analyst needs to understand the network configuration to trace a security incident. Which component should the analyst examine to determine the VM's private IP address?

The network interface (NIC) attached to the VM

GIAC Cloud Forensics Responder

Domain 5Objective 2

Microsoft Azure Virtual Machines GCFR Practice Questions (Page 3)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

Questions 11–15

11application · medium
A forensic investigator needs to preserve the state of an Azure VM's data disk for legal hold. The VM is currently running a production workload. The investigator wants to ensure the data disk is preserved without affecting the running VM. What should the investigator do?
Select an answer first
12foundation · easy
Which Azure RBAC role grants full access to manage all resources in a resource group, including the ability to create and delete VMs, but does NOT grant access to other resource groups?
Select an answer first
13application · medium
A security team needs to collect memory and disk forensics from a running Azure VM without stopping it. The VM is Windows-based and the team has Contributor access to the VM. Which approach should they use?
Select an answer first
14foundation · easy
Which type of IP address is assigned to an Azure VM and can change if the VM is deallocated and then started again?
Select an answer first
15application · easy
A forensic analyst is examining an Azure VM that was part of an availability set. The analyst needs to understand the network configuration to trace a security incident. Which component should the analyst examine to determine the VM's private IP address?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Microsoft Azure Virtual Machines GCFR Practice Questions (Page 3)

Questions 11–15

A forensic investigator needs to preserve the state of an Azure VM's data disk for legal hold. The VM is currently running a production workload. The investigator wants to ensure the data disk is preserved without affecting the running VM. What should the investigator do?

Which Azure RBAC role grants full access to manage all resources in a resource group, including the ability to create and delete VMs, but does NOT grant access to other resource groups?

A security team needs to collect memory and disk forensics from a running Azure VM without stopping it. The VM is Windows-based and the team has Contributor access to the VM. Which approach should they use?

Which type of IP address is assigned to an Azure VM and can change if the VM is deallocated and then started again?

A forensic analyst is examining an Azure VM that was part of an availability set. The analyst needs to understand the network configuration to trace a security incident. Which component should the analyst examine to determine the VM's private IP address?

Keep studying — Microsoft Azure Forensics