A forensic team is analyzing a compromised Azure VM and needs to identify which network interface is associated with the VM's public IP address. The VM has multiple NICs. Which Azure resource should they examine to determine the correct NIC?

The Azure Activity Log for IP address assignments.

The VM's OS-level network configuration.

The public IP address resource's associated NIC configuration.

The VM's boot diagnostics logs.

Which of the following is a characteristic of the classic (Azure Service Manager) deployment model for VMs?

Uses a flat, service-based management model

Allows template-based deployment of all resources

Is the default model for all new VMs

Supports resource-level RBAC and tagging

An incident responder needs to collect forensic data from an Azure VM that is still running but has a suspected rootkit that may hide processes. The responder wants to minimize the chance of the rootkit evading detection. Which collection method is most appropriate?

Use Azure Monitor to collect performance counters.

Create a snapshot of the OS disk and analyze it offline.

Use an agent-based collection tool that runs inside the guest OS.

Attach a new disk and copy the OS disk contents while the VM is running.

A forensic analyst is investigating a VM that failed to boot after a suspected compromise. The analyst needs to determine if the VM's boot process was interrupted by a kernel panic or a missing driver. Which Azure feature should they use to review the boot sequence?

Boot Diagnostics with serial console output.

Network Security Group flow logs.

Azure Monitor metrics for CPU and memory usage.

Azure Activity Log entries for VM start operations.

GIAC Cloud Forensics Responder

Domain 5Objective 2

Microsoft Azure Virtual Machines GCFR Practice Questions (Page 4)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

Questions 16–20

16application · medium
A forensic team is analyzing a compromised Azure VM and needs to identify which network interface is associated with the VM's public IP address. The VM has multiple NICs. Which Azure resource should they examine to determine the correct NIC?
Select an answer first
17foundation · easy
Which Azure feature groups multiple VMs to provide high availability by placing them in separate fault domains and update domains?
Select an answer first
18foundation · easy
Which of the following is a characteristic of the classic (Azure Service Manager) deployment model for VMs?
Select an answer first
19application · medium
An incident responder needs to collect forensic data from an Azure VM that is still running but has a suspected rootkit that may hide processes. The responder wants to minimize the chance of the rootkit evading detection. Which collection method is most appropriate?
Select an answer first
20application · medium
A forensic analyst is investigating a VM that failed to boot after a suspected compromise. The analyst needs to determine if the VM's boot process was interrupted by a kernel panic or a missing driver. Which Azure feature should they use to review the boot sequence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.