Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Eccouncil 312-49 Exam - Topic 1 Question 70 Discussion

Donald made an OS disk snapshot of a compromised Azure VM under a resource group being used by the affected company as a part of forensic analysis process. He then created a vhd file out of the snapshot and stored it in a file share and as a page blob as backup in a storage account under different region. What Is the next thing he should do as a security measure?
B) Delete the snapshot from the source resource group
A) Recommend changing the access policies followed by the company
C) Delete the OS disk of the affected VM altogether
D) Create another VM by using the snapshot

Eccouncil 312-49 Exam - Topic 1 Question 70 Discussion

Actual exam question for Eccouncil's 312-49 exam
Question #: 70
Topic #: 1
[All 312-49 Questions]

Donald made an OS disk snapshot of a compromised Azure VM under a resource group being used by the affected company as a part of forensic analysis process. He then created a vhd file out of the snapshot and stored it in a file share and as a page blob as backup in a storage account under different region. What Is the next thing he should do as a security measure?

Show Suggested Answer Hide Answer
Suggested Answer: B

by Sheridan at Sep 19, 2024, 04:58 AM

Limited Time Offer

25%

Off

Get Premium 312-49 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Clarinda
9 months ago
Creating another VM could lead to more issues if the threat persists.
upvoted 0 times
...
Lavera
9 months ago
Deleting the OS disk seems too extreme.
upvoted 0 times
...
Stephaine
10 months ago
Surprised he didn't create a new VM from the snapshot first!
upvoted 0 times
...
Lavonna
10 months ago
I think deleting the snapshot is a bad idea.
upvoted 0 times
...
Lea
10 months ago
Definitely recommend changing the access policies!
upvoted 0 times
...
Rodolfo
10 months ago
I feel like deleting the OS disk altogether could be too drastic. We need to analyze the data first before making such a decision.
upvoted 0 times
...
Skye
11 months ago
Creating another VM from the snapshot sounds familiar, but I wonder if that would just reintroduce the same vulnerabilities.
upvoted 0 times
...
Reuben
11 months ago
I'm not entirely sure, but deleting the snapshot from the source resource group might be risky. I remember something about preserving evidence in forensics.
upvoted 0 times
...
Rashad
11 months ago
I think he should probably recommend changing the access policies. It seems like a good way to secure the environment after a compromise.
upvoted 0 times
...
Alex
11 months ago
Based on the information provided, I believe the best course of action is to delete the snapshot from the source resource group. That way, we can prevent any further potential misuse of the compromised data.
upvoted 0 times
...
Emogene
11 months ago
I'm a bit confused on the details here. Can we go over the question again? I want to make sure I understand the full context before deciding.
upvoted 0 times
...
Dahlia
11 months ago
Okay, let's see. I think the key here is to minimize the risk of the compromised data being accessed or misused. Deleting the snapshot seems like the safest bet.
upvoted 0 times
...
Olene
11 months ago
Hmm, this seems like a tricky one. I'll need to think through the security implications of each option carefully.
upvoted 0 times
...
Maia
11 months ago
I'm pretty confident that deleting the snapshot is the right move here. It's the most direct way to secure the compromised data and prevent it from being accessed or spread further.
upvoted 0 times
...
Tamra
2 years ago
Option D sounds tempting, but I don't think creating another VM from the compromised snapshot is a good idea. Let's stick to the security basics here.
upvoted 0 times
Pilar
2 years ago
C) Delete the OS disk of the affected VM altogether
upvoted 0 times
...
Julianna
2 years ago
B) Delete the snapshot from the source resource group
upvoted 0 times
...
Bettina
2 years ago
A) Recommend changing the access policies followed by the company
upvoted 0 times
...
...
Herschel
2 years ago
Haha, I bet Donald is regretting not using a self-destructing VM for this forensic analysis. Option C is the only way to be sure!
upvoted 0 times
Pearly
2 years ago
C) Delete the OS disk of the affected VM altogether
upvoted 0 times
...
Rima
2 years ago
B) Delete the snapshot from the source resource group
upvoted 0 times
...
Val
2 years ago
A) Recommend changing the access policies followed by the company
upvoted 0 times
...
...
Alpha
2 years ago
I believe creating another VM using the snapshot would be a good security measure as well.
upvoted 0 times
...
Glennis
2 years ago
I would recommend option A. Changing the access policies could help strengthen the security measures and prevent similar incidents in the future.
upvoted 0 times
Wava
2 years ago
Definitely, security measures need to be strengthened.
upvoted 0 times
...
Peggie
2 years ago
It's important to prevent similar incidents from happening again.
upvoted 0 times
...
Delmy
2 years ago
I agree, changing the access policies is crucial for security.
upvoted 0 times
...
Genevieve
2 years ago
I think option A is the best choice.
upvoted 0 times
...
...
Dianne
2 years ago
I agree with Evette, changing access policies is crucial for security.
upvoted 0 times
...
Dyan
2 years ago
Option B is the way to go. Deleting the snapshot from the source resource group is the prudent move to prevent any further compromise.
upvoted 0 times
Gilbert
2 years ago
B) Delete the snapshot from the source resource group
upvoted 0 times
...
Daren
2 years ago
A) Recommend changing the access policies followed by the company
upvoted 0 times
...
...
Evette
2 years ago
I think Donald should recommend changing the access policies.
upvoted 0 times
...

Save Cancel