An investigator is trying to determine if a user's Azure AD account was used to create a new VM. The investigator has the Azure AD sign-in log showing a sign-in at 10:00, and the Activity Log showing a VM creation at 10:05. However, the sign-in log shows the sign-in was from IP address 1.2.3.4, while the Activity Log shows the VM creation was initiated from IP address 5.6.7.8. What is the most likely explanation?

The VM creation was performed by a different user

The user may have used a different network or a proxy for the VM creation

An organization is preparing for a forensic investigation. They want to ensure that all relevant Azure logs are being collected. Which combination of log sources should they enable to cover control-plane, data-plane, and authentication activity?

Activity Logs and resource logs only

Activity Logs, resource logs, and Azure AD sign-in/audit logs

Activity Logs and Azure AD sign-in logs only

Resource logs and Azure AD audit logs only

GIAC Cloud Forensics Responder

Domain 5Objective 1

Understanding Microsoft Azure and Log Sources GCFR Practice Questions (Page 3)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 11–15

11foundation · easy
Which field is commonly used to correlate Azure Activity Logs with Azure AD sign-in logs to link a management action to a user's authentication event?
Select an answer first
12expert · hard
An investigator is trying to determine if a user's Azure AD account was used to create a new VM. The investigator has the Azure AD sign-in log showing a sign-in at 10:00, and the Activity Log showing a VM creation at 10:05. However, the sign-in log shows the sign-in was from IP address 1.2.3.4, while the Activity Log shows the VM creation was initiated from IP address 5.6.7.8. What is the most likely explanation?
Select an answer first
13foundation · easy
In Microsoft Azure, which component serves as the fundamental organizational unit for grouping related resources and applying access permissions, billing, and policy at a scoped level?
Select an answer first
14foundation · easy
Which Azure feature must be enabled to collect resource logs from a virtual machine, such as application and system event logs?
Select an answer first
15application · medium
An organization is preparing for a forensic investigation. They want to ensure that all relevant Azure logs are being collected. Which combination of log sources should they enable to cover control-plane, data-plane, and authentication activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Understanding Microsoft Azure and Log Sources GCFR Practice Questions (Page 3)

Questions 11–15

Which field is commonly used to correlate Azure Activity Logs with Azure AD sign-in logs to link a management action to a user's authentication event?

In Microsoft Azure, which component serves as the fundamental organizational unit for grouping related resources and applying access permissions, billing, and policy at a scoped level?

Which Azure feature must be enabled to collect resource logs from a virtual machine, such as application and system event logs?

An organization is preparing for a forensic investigation. They want to ensure that all relevant Azure logs are being collected. Which combination of log sources should they enable to cover control-plane, data-plane, and authentication activity?

Keep studying — Microsoft Azure Forensics