Eccouncil 312-49 Exam - Topic 1 Question 70 Discussion

Actual exam question for Eccouncil's 312-49 exam

Question #: 70
Topic #: 1

Donald made an OS disk snapshot of a compromised Azure VM under a resource group being used by the affected company as a part of forensic analysis process. He then created a vhd file out of the snapshot and stored it in a file share and as a page blob as backup in a storage account under different region. What Is the next thing he should do as a security measure?

ARecommend changing the access policies followed by the company

BDelete the snapshot from the source resource group

CDelete the OS disk of the affected VM altogether

DCreate another VM by using the snapshot

Show Suggested Answer

Suggested Answer: B

by Sheridan at Sep 19, 2024, 04:58 AM

Limited Time Offer

25%

Off

Get Premium 312-49 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Clarinda

3 months ago

Creating another VM could lead to more issues if the threat persists.

upvoted 0 times

...

Lavera

3 months ago

Deleting the OS disk seems too extreme.

upvoted 0 times

...

Stephaine

3 months ago

Surprised he didn't create a new VM from the snapshot first!

upvoted 0 times

...

Lavonna

4 months ago

I think deleting the snapshot is a bad idea.

upvoted 0 times

...

Lea

4 months ago

Definitely recommend changing the access policies!

upvoted 0 times

...

Rodolfo

4 months ago

I feel like deleting the OS disk altogether could be too drastic. We need to analyze the data first before making such a decision.

upvoted 0 times

...

Skye

4 months ago

Creating another VM from the snapshot sounds familiar, but I wonder if that would just reintroduce the same vulnerabilities.

upvoted 0 times

...

Reuben

4 months ago

I'm not entirely sure, but deleting the snapshot from the source resource group might be risky. I remember something about preserving evidence in forensics.

upvoted 0 times

...

Rashad

5 months ago

I think he should probably recommend changing the access policies. It seems like a good way to secure the environment after a compromise.

upvoted 0 times

...

Alex

5 months ago

Based on the information provided, I believe the best course of action is to delete the snapshot from the source resource group. That way, we can prevent any further potential misuse of the compromised data.

upvoted 0 times

...

Emogene

5 months ago

I'm a bit confused on the details here. Can we go over the question again? I want to make sure I understand the full context before deciding.

upvoted 0 times

...

Dahlia

5 months ago

Okay, let's see. I think the key here is to minimize the risk of the compromised data being accessed or misused. Deleting the snapshot seems like the safest bet.

upvoted 0 times

...

Olene

5 months ago

Hmm, this seems like a tricky one. I'll need to think through the security implications of each option carefully.

upvoted 0 times

...

Maia

5 months ago

I'm pretty confident that deleting the snapshot is the right move here. It's the most direct way to secure the compromised data and prevent it from being accessed or spread further.

upvoted 0 times

...

Tamra

1 year ago

Option D sounds tempting, but I don't think creating another VM from the compromised snapshot is a good idea. Let's stick to the security basics here.

upvoted 0 times