During an incident, a forensic analyst needs to determine which network connections were made to a compromised Azure VM. The VM is still running and the analyst has Contributor access to the VM. Which data source should the analyst examine first?

Network Security Group flow logs

A forensic investigator is assigned to an incident involving an Azure VM. The investigator has been granted the 'Reader' role on the VM but needs to collect disk evidence. The organization's policy requires least privilege. What should the investigator do?

Request a temporary custom role that includes Microsoft.Compute/disks/read and Microsoft.Compute/snapshots/write permissions.

Use Azure CLI with the 'Reader' role to create a snapshot.

Use the 'Virtual Machine Contributor' role because it allows all VM operations.

Ask an administrator to create a snapshot using their account.

A forensic investigator needs to collect disk evidence from an Azure VM but does not have permissions to create snapshots or attach disks. The investigator has been granted the 'Virtual Machine Contributor' role. What should the investigator do?

Use Azure CLI to create a snapshot because CLI commands do not require RBAC.

Request a role that includes Microsoft.Compute/disks/snapshot/action, such as 'Disk Snapshot Contributor' or a custom role.

Attach the disk to a new VM using the 'Virtual Machine Contributor' role.

Use the Azure portal to create a snapshot because the portal bypasses RBAC.

An organization has a legacy Azure VM that was created using the classic deployment model. A forensic investigator needs to attach a managed data disk to this VM to collect evidence. What is the most important consideration?

The investigator must use Azure PowerShell because the portal does not support classic VMs.

The classic VM may not support managed disks, so the investigator must use unmanaged disks or migrate the VM to Resource Manager.

The classic VM cannot have any data disks attached, so evidence must be collected via the network.

The classic VM must be stopped and deallocated before attaching any disk.

GIAC Cloud Forensics Responder

Domain 5Objective 2

Microsoft Azure Virtual Machines GCFR Practice Questions (Page 8)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

Questions 36–40

36foundation · easy
Which forensic data collection method for Azure VMs involves installing a software component on the VM to collect logs, artifacts, or other data from the guest OS?
Select an answer first
37application · medium
During an incident, a forensic analyst needs to determine which network connections were made to a compromised Azure VM. The VM is still running and the analyst has Contributor access to the VM. Which data source should the analyst examine first?
Select an answer first
38expert · hard
A forensic investigator is assigned to an incident involving an Azure VM. The investigator has been granted the 'Reader' role on the VM but needs to collect disk evidence. The organization's policy requires least privilege. What should the investigator do?
Select an answer first
39application · medium
A forensic investigator needs to collect disk evidence from an Azure VM but does not have permissions to create snapshots or attach disks. The investigator has been granted the 'Virtual Machine Contributor' role. What should the investigator do?
Select an answer first
40application · hard
An organization has a legacy Azure VM that was created using the classic deployment model. A forensic investigator needs to attach a managed data disk to this VM to collect evidence. What is the most important consideration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.