MENU
Donald made an OS disk snapshot of a compromised Azure VM under a resource group being used by the affected company as a part of forensic analysis process. He then created a vhd file out of the snapshot and stored it in a file share and as a page blob as backup in a storage account under different region. What Is the next thing he should do as a security measure?
Suggested Answer: B
Get Premium 312-49 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
33 comments · newest first
CL
Clarinda
11 months ago
Creating another VM could lead to more issues if the threat persists.
LA
Lavera
11 months ago
Deleting the OS disk seems too extreme.
ST
Stephaine
11 months ago
Surprised he didn't create a new VM from the snapshot first!
LA
Lavonna
12 months ago
I think deleting the snapshot is a bad idea.
LE
Lea
12 months ago
Definitely recommend changing the access policies!
RO
Rodolfo
1 year ago
I feel like deleting the OS disk altogether could be too drastic. We need to analyze the data first before making such a decision.
SK
Skye
1 year ago
Creating another VM from the snapshot sounds familiar, but I wonder if that would just reintroduce the same vulnerabilities.
RE
Reuben
1 year ago
I'm not entirely sure, but deleting the snapshot from the source resource group might be risky. I remember something about preserving evidence in forensics.
RA
Rashad
1 year ago
I think he should probably recommend changing the access policies. It seems like a good way to secure the environment after a compromise.
AL
Alex
1 year ago
Based on the information provided, I believe the best course of action is to delete the snapshot from the source resource group. That way, we can prevent any further potential misuse of the compromised data.
EM
Emogene
1 year ago
I'm a bit confused on the details here. Can we go over the question again? I want to make sure I understand the full context before deciding.
DA
Dahlia
1 year ago
Okay, let's see. I think the key here is to minimize the risk of the compromised data being accessed or misused. Deleting the snapshot seems like the safest bet.
OL
Olene
1 year ago
Hmm, this seems like a tricky one. I'll need to think through the security implications of each option carefully.
MA
Maia
1 year ago
I'm pretty confident that deleting the snapshot is the right move here. It's the most direct way to secure the compromised data and prevent it from being accessed or spread further.
TA
Tamra
2 years ago
Option D sounds tempting, but I don't think creating another VM from the compromised snapshot is a good idea. Let's stick to the security basics here.
PI
Pilar
2 years ago
C) Delete the OS disk of the affected VM altogether
JU
Julianna
2 years ago
B) Delete the snapshot from the source resource group
BE
Bettina
2 years ago
A) Recommend changing the access policies followed by the company
HE
Herschel
2 years ago
Haha, I bet Donald is regretting not using a self-destructing VM for this forensic analysis. Option C is the only way to be sure!
PE
Pearly
2 years ago
C) Delete the OS disk of the affected VM altogether
RI
Rima
2 years ago
B) Delete the snapshot from the source resource group
VA
Val
2 years ago
A) Recommend changing the access policies followed by the company
AL
Alpha
2 years ago
I believe creating another VM using the snapshot would be a good security measure as well.
GL
Glennis
2 years ago
I would recommend option A. Changing the access policies could help strengthen the security measures and prevent similar incidents in the future.
WA
Wava
2 years ago
Definitely, security measures need to be strengthened.
PE
Peggie
2 years ago
It's important to prevent similar incidents from happening again.
DE
Delmy
2 years ago
I agree, changing the access policies is crucial for security.
GE
Genevieve
2 years ago
I think option A is the best choice.
DI
Dianne
2 years ago
I agree with Evette, changing access policies is crucial for security.
DY
Dyan
2 years ago
Option B is the way to go. Deleting the snapshot from the source resource group is the prudent move to prevent any further compromise.
GI
Gilbert
2 years ago
B) Delete the snapshot from the source resource group
DA
Daren
2 years ago
A) Recommend changing the access policies followed by the company
EV
Evette
2 years ago
I think Donald should recommend changing the access policies.