Free Preparation Discussions
MENU
Eccouncil 312-40 Exam - Topic 2 Question 27 Discussion
Topic #: 2
An IT company uses two resource groups, named Production-group and Security-group, under the same subscription ID. Under the Production-group, a VM called Ubuntu18 is suspected to be compromised. As a forensic investigator, you need to take a snapshot (ubuntudisksnap) of the OS disk of the suspect virtual machine Ubuntu18 for further investigation and copy the snapshot to a storage account under Security-group.
Identify the next step in the investigation of the security incident in Azure?
When an IT company suspects that a VM called Ubuntu18 in the Production-group has been compromised, it is essential to perform a forensic investigation. The process of taking a snapshot and ensuring its integrity and accessibility involves several steps:
Snapshot Creation: First, create a snapshot of the OS disk of the suspect VM, named ubuntudisksnap. This snapshot is a point-in-time copy of the VM's disk, ensuring that all data at that moment is captured.
Snapshot Security: Next, to transfer this snapshot securely to a storage account under the Security-group, a shared access signature (SAS) needs to be generated. A SAS provides delegated access to Azure storage resources without exposing the storage account keys.
Data Transfer: With the SAS token, the snapshot can be securely copied to a storage account in the Security-group. This method ensures that only authorized personnel can access the snapshot for further investigation.
Further Analysis: After copying the snapshot, it can be mounted onto a forensic workstation for detailed examination. This step involves examining the contents of the snapshot for any malicious activity or artifacts left by the attacker.
Generating a shared access signature is a critical step in ensuring that the snapshot can be securely accessed and transferred without compromising the integrity and security of the data.
Microsoft Azure Documentation on Shared Access Signatures (SAS)
Azure Security Best Practices and Patterns
Cloud Security Alliance (CSA) Security Guidance for Critical Areas of Focus in Cloud Computing
King
3 months agoIzetta
4 months agoGerald
4 months agoMerilyn
4 months agoDalene
4 months agoHalina
5 months agoBritt
5 months agoCornell
5 months agoLaurena
5 months agoJaclyn
6 months agoBrent
6 months agoJoesph
6 months agoMariann
6 months agoLinn
6 months agoHoward
11 months agoWinfred
10 months agoDaron
10 months agoTheron
10 months agoSabrina
11 months agoParis
10 months agoDalene
10 months agoBlair
11 months agoMargart
12 months agoStefanie
11 months agoTamar
11 months agoLindsey
1 year agoElvis
1 year agoFlorencia
11 months agoLashaunda
11 months agoJesse
11 months agoMona
11 months agoAretha
12 months agoMaryann
12 months agoSina
1 year agoDonte
1 year ago