QuestionQ324
Procedures and MethodologyDuring ransomware triage in a Microsoft Azure environment, forensic analysts must preserve evidence from a compromised azure-ubuntu virtual machine by creating a snapshot of its OS disk through the Azure Portal. Which sequence correctly completes this task?
- A Stop the azure-ubuntu VM → Locate the azure-ubuntu OS disk from the Production-group and click on it → Click on the Create Snapshot button → On the Create Snapshot page, give a desired name for the OS snapshot, select the snapshot type as read-only, and select a storage type → Click on Review+create → Click on Create.
- B Create a snapshot of the OS disk of the suspect VM → Copy the snapshot to a storage account under a different resource group → Delete the snapshot from the source resource group and create a backup copy → Mount the snapshot onto the forensic workstation.
- C Install Azure CLI on a remote forensic workstation → az login → Execute the az vm show command with "storageProfile.osDisk.name" to view the source disk ID → Run the az snapshot create command with the required parameters.
- D Locate the azure-ubuntu OS disk from the Production-group and click on it → Click on the Create Snapshot button → Give a desired name, select the snapshot type as read-only, and select a storage type → Click on Review+create → Click on Create.
Community Discussion