A security team needs to collect memory and disk forensics from a fleet of Azure VMs in response to a suspected compromise. They want to use a method that does not require installing a persistent agent on each VM. Which approach should they use?

Use Azure Automation State Configuration to push a desired state to the VMs.

Enable Azure Monitor Agent on each VM and configure data collection rules.

Deploy a VM extension that runs a one-time script to collect data and uploads it to a storage account.

Attach a forensic workstation to each VM's virtual network and use remote tools.

GIAC Cloud Forensics Responder

Domain 5Objective 2

Microsoft Azure Virtual Machines GCFR Practice Questions (Page 5)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

Questions 21–25

21foundation · easy
In which Azure VM state does the VM continue to incur compute charges but the operating system is not running, and the VM's disks remain attached?
Select an answer first
22foundation · easy
Which Azure RBAC role is the minimum required to view the properties and disks of an Azure VM without making any changes?
Select an answer first
23foundation · easy
Which Azure VM disk type is non-persistent and should NOT be relied upon for forensic evidence because its contents are lost when the VM is deallocated?
Select an answer first
24foundation · easy
Which type of Azure VM disk is used to store the operating system and is the primary target for forensic analysis of the OS and installed applications?
Select an answer first
25application · medium
A security team needs to collect memory and disk forensics from a fleet of Azure VMs in response to a suspected compromise. They want to use a method that does not require installing a persistent agent on each VM. Which approach should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Microsoft Azure Virtual Machines GCFR Practice Questions (Page 5)

Questions 21–25

In which Azure VM state does the VM continue to incur compute charges but the operating system is not running, and the VM's disks remain attached?

Which Azure RBAC role is the minimum required to view the properties and disks of an Azure VM without making any changes?

Which Azure VM disk type is non-persistent and should NOT be relied upon for forensic evidence because its contents are lost when the VM is deallocated?

Which type of Azure VM disk is used to store the operating system and is the primary target for forensic analysis of the OS and installed applications?

A security team needs to collect memory and disk forensics from a fleet of Azure VMs in response to a suspected compromise. They want to use a method that does not require installing a persistent agent on each VM. Which approach should they use?

Keep studying — Microsoft Azure Forensics