Free Preparation Discussions
MENU
Eccouncil 312-40 Exam - Topic 2 Question 27 Discussion
Topic #: 2
An IT company uses two resource groups, named Production-group and Security-group, under the same subscription ID. Under the Production-group, a VM called Ubuntu18 is suspected to be compromised. As a forensic investigator, you need to take a snapshot (ubuntudisksnap) of the OS disk of the suspect virtual machine Ubuntu18 for further investigation and copy the snapshot to a storage account under Security-group.
Identify the next step in the investigation of the security incident in Azure?
When an IT company suspects that a VM called Ubuntu18 in the Production-group has been compromised, it is essential to perform a forensic investigation. The process of taking a snapshot and ensuring its integrity and accessibility involves several steps:
Snapshot Creation: First, create a snapshot of the OS disk of the suspect VM, named ubuntudisksnap. This snapshot is a point-in-time copy of the VM's disk, ensuring that all data at that moment is captured.
Snapshot Security: Next, to transfer this snapshot securely to a storage account under the Security-group, a shared access signature (SAS) needs to be generated. A SAS provides delegated access to Azure storage resources without exposing the storage account keys.
Data Transfer: With the SAS token, the snapshot can be securely copied to a storage account in the Security-group. This method ensures that only authorized personnel can access the snapshot for further investigation.
Further Analysis: After copying the snapshot, it can be mounted onto a forensic workstation for detailed examination. This step involves examining the contents of the snapshot for any malicious activity or artifacts left by the attacker.
Generating a shared access signature is a critical step in ensuring that the snapshot can be securely accessed and transferred without compromising the integrity and security of the data.
Microsoft Azure Documentation on Shared Access Signatures (SAS)
Azure Security Best Practices and Patterns
Cloud Security Alliance (CSA) Security Guidance for Critical Areas of Focus in Cloud Computing
King
2 months agoIzetta
2 months agoGerald
2 months agoMerilyn
3 months agoDalene
3 months agoHalina
3 months agoBritt
3 months agoCornell
4 months agoLaurena
4 months agoJaclyn
4 months agoBrent
4 months agoJoesph
4 months agoMariann
5 months agoLinn
5 months agoHoward
10 months agoWinfred
8 months agoDaron
8 months agoTheron
9 months agoSabrina
10 months agoParis
8 months agoDalene
9 months agoBlair
9 months agoMargart
10 months agoStefanie
9 months agoTamar
10 months agoLindsey
11 months agoElvis
11 months agoFlorencia
10 months agoLashaunda
10 months agoJesse
10 months agoMona
10 months agoAretha
10 months agoMaryann
10 months agoSina
11 months agoDonte
11 months ago