QuestionQ324

Procedures and Methodology

During ransomware triage in a Microsoft Azure environment, forensic analysts must preserve evidence from a compromised azure-ubuntu virtual machine by creating a snapshot of its OS disk through the Azure Portal. Which sequence correctly completes this task?

  • A Stop the azure-ubuntu VM → Locate the azure-ubuntu OS disk from the Production-group and click on it → Click on the Create Snapshot button → On the Create Snapshot page, give a desired name for the OS snapshot, select the snapshot type as read-only, and select a storage type → Click on Review+create → Click on Create.
  • B Create a snapshot of the OS disk of the suspect VM → Copy the snapshot to a storage account under a different resource group → Delete the snapshot from the source resource group and create a backup copy → Mount the snapshot onto the forensic workstation.
  • C Install Azure CLI on a remote forensic workstation → az login → Execute the az vm show command with "storageProfile.osDisk.name" to view the source disk ID → Run the az snapshot create command with the required parameters.
  • D Locate the azure-ubuntu OS disk from the Production-group and click on it → Click on the Create Snapshot button → Give a desired name, select the snapshot type as read-only, and select a storage type → Click on Review+create → Click on Create.
Explanation

An Azure managed-disk snapshot is a full, read-only, point-in-time copy of an OS or data disk. In the Azure portal, the analyst selects the source OS disk, creates the snapshot, configures its name, snapshot and storage settings, and submits it with Review + create and Create. Stopping the VM is not required solely to create a snapshot; Microsoft calls for a clean shutdown when the snapshot will be used to create a new VM.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!