A forensic investigator is analyzing a breach where an attacker gained access to an Azure subscription. The investigator has the following logs: Azure AD sign-in logs showing a successful sign-in from an unusual IP at 14:32, Activity Logs showing a role assignment change at 14:35, and resource logs from a VM showing a data exfiltration at 14:40. The investigator needs to prove that the role assignment change was performed by the same user who signed in. Which approach is most effective?

Correlate the user principal name (UPN) and IP address across the sign-in log and the Activity Log

Assume the same user because the times are close

Use the resource logs from the VM to identify the user

Use Azure AD audit logs to find the role assignment change

When reconstructing a timeline of events in Azure, which approach is most effective for correlating logs from different sources?

Sorting all logs by timestamp and merging them into a single timeline

Analyzing each log source independently without cross-referencing

Focusing only on logs from the most critical resource

Using only Azure AD logs to determine all activity

An investigator is reconstructing a timeline of an attack. They have the following logs: Azure AD sign-in logs show a user authenticated at 10:00 UTC. Activity Logs show a VM creation at 10:05 UTC. Resource logs for the VM show a suspicious process execution at 10:10 UTC. The investigator needs to determine the attacker's initial access vector. Which additional log source would provide the most useful information?

Azure AD sign-in logs for other users

Azure AD audit logs to see if the user's password was changed or MFA was modified

Azure Activity Logs for the resource group to see who created the VM

Resource logs for other VMs in the same resource group

An organization is required to retain Azure Activity Logs and resource logs for 3 years for compliance. They currently have no diagnostic settings configured. What is the most efficient way to meet this requirement?

Configure diagnostic settings to stream both Activity Logs and resource logs to a Log Analytics workspace with a 3-year retention policy

Rely on the default 90-day retention of the Activity Log and enable resource logs for all resources

Export Activity Logs to an Azure Storage account with a lifecycle management policy set to 3 years

Use Azure Monitor's built-in archive feature to store logs indefinitely

GIAC Cloud Forensics Responder

Domain 5Objective 1

Understanding Microsoft Azure and Log Sources GCFR Practice Questions (Page 6)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 26–30

26expert · hard
A forensic investigator is analyzing a breach where an attacker gained access to an Azure subscription. The investigator has the following logs: Azure AD sign-in logs showing a successful sign-in from an unusual IP at 14:32, Activity Logs showing a role assignment change at 14:35, and resource logs from a VM showing a data exfiltration at 14:40. The investigator needs to prove that the role assignment change was performed by the same user who signed in. Which approach is most effective?
Select an answer first
27foundation · easy
When reconstructing a timeline of events in Azure, which approach is most effective for correlating logs from different sources?
Select an answer first
28expert · hard
An investigator is reconstructing a timeline of an attack. They have the following logs: Azure AD sign-in logs show a user authenticated at 10:00 UTC. Activity Logs show a VM creation at 10:05 UTC. Resource logs for the VM show a suspicious process execution at 10:10 UTC. The investigator needs to determine the attacker's initial access vector. Which additional log source would provide the most useful information?
Select an answer first
29foundation · easy
Which Azure resource type is primarily used to store unstructured data such as virtual machine disks, logs, and backups, and can be a key source of forensic evidence?
Select an answer first
30application · medium
An organization is required to retain Azure Activity Logs and resource logs for 3 years for compliance. They currently have no diagnostic settings configured. What is the most efficient way to meet this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Understanding Microsoft Azure and Log Sources GCFR Practice Questions (Page 6)

Questions 26–30

When reconstructing a timeline of events in Azure, which approach is most effective for correlating logs from different sources?

Which Azure resource type is primarily used to store unstructured data such as virtual machine disks, logs, and backups, and can be a key source of forensic evidence?

An organization is required to retain Azure Activity Logs and resource logs for 3 years for compliance. They currently have no diagnostic settings configured. What is the most efficient way to meet this requirement?

Keep studying — Microsoft Azure Forensics