Discuss EC-Council 312-40 Exam Topic 2 Question 27

An IT company uses two resource groups, named Production-group and Security-group, under the same subscription ID. Under the Production-group, a VM called Ubuntu18 is suspected to be compromised. As a forensic investigator, you need to take a snapshot (ubuntudisksnap) of the OS disk of the suspect virtual machine Ubuntu18 for further investigation and copy the snapshot to a storage account under Security-group.

Identify the next step in the investigation of the security incident in Azure?

ACopy the snapshot to file share

BGenerate shared access signature

CCreate a backup copy of snapshot in a blob container

DMount the snapshot onto the forensic workstation

Suggested Answer: B

When an IT company suspects that a VM called Ubuntu18 in the Production-group has been compromised, it is essential to perform a forensic investigation. The process of taking a snapshot and ensuring its integrity and accessibility involves several steps:

Snapshot Creation: First, create a snapshot of the OS disk of the suspect VM, named ubuntudisksnap. This snapshot is a point-in-time copy of the VM's disk, ensuring that all data at that moment is captured.

Snapshot Security: Next, to transfer this snapshot securely to a storage account under the Security-group, a shared access signature (SAS) needs to be generated. A SAS provides delegated access to Azure storage resources without exposing the storage account keys.

Data Transfer: With the SAS token, the snapshot can be securely copied to a storage account in the Security-group. This method ensures that only authorized personnel can access the snapshot for further investigation.

Further Analysis: After copying the snapshot, it can be mounted onto a forensic workstation for detailed examination. This step involves examining the contents of the snapshot for any malicious activity or artifacts left by the attacker.

Generating a shared access signature is a critical step in ensuring that the snapshot can be securely accessed and transferred without compromising the integrity and security of the data.

Microsoft Azure Documentation on Shared Access Signatures (SAS)

Azure Security Best Practices and Patterns

Cloud Security Alliance (CSA) Security Guidance for Critical Areas of Focus in Cloud Computing

Get Premium 312-40 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

35 comments · newest first

King 10 months ago

Copying to a file share? That's not the right move here.

Izetta 10 months ago

Wait, can you really just mount the snapshot directly? Seems risky.

Gerald 10 months ago

Totally agree, that's the safest way to handle it!

Merilyn 11 months ago

You need to create a backup copy of the snapshot in a blob container.

Dalene 11 months ago

Generating a shared access signature is also important for access control.

Halina 11 months ago

Mounting the snapshot onto the forensic workstation sounds like something we might do later, but I don't think that's the immediate next step.

Britt 11 months ago

I practiced a similar question where we had to create a backup copy of a snapshot, so I feel like option C could be the right choice here.

Cornell 12 months ago

I think generating a shared access signature might be important for accessing the snapshot later, but I can't recall if it's the next step.

Laurena 12 months ago

I remember we talked about snapshots in class, but I'm not sure if we should copy it to a file share or a blob container.

Jaclyn 1 year ago

Yeah, that makes sense. Creating a backup in a blob container seems like the most appropriate next step in this forensic investigation.

Brent 1 year ago

Based on the question, I believe the correct answer is to create a backup copy of the snapshot in a blob container under the Security-group. That way, it's stored securely and can be accessed for further investigation.

Joesph 1 year ago

I'm a bit confused on the best way to do that. Should I just copy it to a file share or is there a more secure option?

Mariann 1 year ago

Okay, I think I've got this. The key is to copy the snapshot to a secure location, like a storage account under the Security-group.

Linn 1 year ago

Hmm, this looks like a tricky one. I'll need to carefully think through the steps to make sure I don't miss anything.

Howard 1 year ago

Haha, I bet the exam writer is just trying to trick us with all these options. Option D is the only one that makes sense - get that snapshot onto a forensic machine and let the magic happen!

Winfred 1 year ago

↳ replying to Howard

Definitely, that's the best way to analyze the compromised VM.

Daron 1 year ago

↳ replying to Howard

Yeah, mounting the snapshot onto a forensic workstation is crucial for further investigation.

Theron 1 year ago

↳ replying to Howard

I agree, option D seems like the most logical next step.

Sabrina 1 year ago

D is the correct answer. You need to mount the snapshot on a forensic workstation to analyze the compromised VM. Why complicate things with a blob container when you can just mount it directly?

Paris 1 year ago

↳ replying to Sabrina

D) Mount the snapshot onto the forensic workstation

Dalene 1 year ago

↳ replying to Sabrina

C) Create a backup copy of snapshot in a blob container

Blair 1 year ago

↳ replying to Sabrina

B) Generate shared access signature

Margart 2 years ago

I agree with Elvis. Option C is the way to go. Keeping the snapshot in a secure location under the Security-group is crucial for a proper forensic investigation.

Stefanie 1 year ago

↳ replying to Margart

C) Create a backup copy of snapshot in a blob container

Tamar 1 year ago

↳ replying to Margart

B) Generate shared access signature

Lindsey 2 years ago

I believe creating a backup copy of the snapshot in a blob container is also important for preserving evidence.

Elvis 2 years ago

Option C seems the most logical choice to me. Storing the snapshot in a blob container under the Security-group would ensure better security and control during the investigation.

Florencia 1 year ago

↳ replying to Elvis

D) Mount the snapshot onto the forensic workstation

Lashaunda 1 year ago

↳ replying to Elvis

C) Create a backup copy of snapshot in a blob container

Jesse 1 year ago

↳ replying to Elvis

B) Generate shared access signature

Mona 1 year ago

↳ replying to Elvis

D) Mount the snapshot onto the forensic workstation

Aretha 2 years ago

↳ replying to Elvis

C) Create a backup copy of snapshot in a blob container

Maryann 2 years ago

↳ replying to Elvis

B) Generate shared access signature

Sina 2 years ago

I agree with Donte, mounting the snapshot will allow us to analyze the compromised VM.

Donte 2 years ago

I think the next step is to mount the snapshot onto the forensic workstation.

EC-Council 312-40 Exam - Topic 2 Question 27 Discussion