A forensic investigator is called to preserve evidence from an Azure VM that is currently in the 'Stopped (deallocated)' state. The VM's OS disk is a managed disk. The investigator needs to ensure the evidence is preserved for a court case that may take months. The organization wants to minimize storage costs while maintaining the ability to analyze the disk later. What is the best course of action?

Leave the VM in its current state and do nothing.

Copy the VHD to a cold storage account and delete the VM.

Create a snapshot of the OS disk and store it in the same region with a standard storage tier.

Start the VM and use Azure Backup to create a long-term retention backup.

A cloud forensics team is preparing to acquire evidence from an Azure VM. The team has been granted 'Virtual Machine Contributor' role on the VM. They need to create a snapshot of the OS disk for analysis. What is the most accurate statement about their ability to do so?

They cannot create a snapshot because Virtual Machine Contributor does not include disk snapshot permissions.

They can create a snapshot because Virtual Machine Contributor includes permission to manage disks.

They can create a snapshot by using the Azure portal, which bypasses RBAC.

They can create a snapshot but only if they also have Reader role on the disk.

A forensic investigator is examining an old Azure VM that was created using the classic deployment model. The investigator needs to assign a specific RBAC role to a colleague so they can access the VM's disks for analysis. What is the primary limitation they will encounter?

Classic VMs support RBAC but require the colleague to be added to the Azure Active Directory tenant first.

Classic VMs do not support RBAC at all, so access must be granted via co-administrator settings.

Classic VMs support RBAC only for the Owner role, not Contributor or Reader.

Classic VMs support RBAC but only at the subscription level, not the resource level.

A security analyst needs to review the login history for an Azure VM to identify unauthorized access attempts. Which Azure log should the analyst query?

Windows Event Logs (Security log) collected via Azure Monitor

GIAC Cloud Forensics Responder

Domain 5Objective 2

Microsoft Azure Virtual Machines GCFR Practice Questions (Page 6)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

Questions 26–30

26expert · hard
A forensic investigator is called to preserve evidence from an Azure VM that is currently in the 'Stopped (deallocated)' state. The VM's OS disk is a managed disk. The investigator needs to ensure the evidence is preserved for a court case that may take months. The organization wants to minimize storage costs while maintaining the ability to analyze the disk later. What is the best course of action?
Select an answer first
27expert · hard
A cloud forensics team is preparing to acquire evidence from an Azure VM. The team has been granted 'Virtual Machine Contributor' role on the VM. They need to create a snapshot of the OS disk for analysis. What is the most accurate statement about their ability to do so?
Select an answer first
28application · medium
A forensic investigator is examining an old Azure VM that was created using the classic deployment model. The investigator needs to assign a specific RBAC role to a colleague so they can access the VM's disks for analysis. What is the primary limitation they will encounter?
Select an answer first
29foundation · easy
Which Azure VM extension is used to run a script on a VM after it is provisioned, which can be used to deploy forensic collection tools?
Select an answer first
30application · medium
A security analyst needs to review the login history for an Azure VM to identify unauthorized access attempts. Which Azure log should the analyst query?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Microsoft Azure Virtual Machines GCFR Practice Questions (Page 6)

Questions 26–30

A cloud forensics team is preparing to acquire evidence from an Azure VM. The team has been granted 'Virtual Machine Contributor' role on the VM. They need to create a snapshot of the OS disk for analysis. What is the most accurate statement about their ability to do so?

A forensic investigator is examining an old Azure VM that was created using the classic deployment model. The investigator needs to assign a specific RBAC role to a colleague so they can access the VM's disks for analysis. What is the primary limitation they will encounter?

Which Azure VM extension is used to run a script on a VM after it is provisioned, which can be used to deploy forensic collection tools?

A security analyst needs to review the login history for an Azure VM to identify unauthorized access attempts. Which Azure log should the analyst query?

Keep studying — Microsoft Azure Forensics