FORGC2

Which WAD table contains the Windows event logs?

• 
  

• WADWindowsEventLogsTable

• WADDiagnosticInfrastructureLogsTable

• WADPerformaceCountersTable

• WADMetricsPT1MPDV2S########

Answer explanation

WADWindowsEventLogsTable is the most interesting table for incident response and forensics, as it contains the Windows event logs. This is a great opportunity to obtain operating system logs without the need to log in the virtual machine itself.

When are network security groups created in Azure?

• Automatically, with every VM unless an existing one is specified

• Automatically, every night at 3 a.m. ET

• Automatically, with every VM

• Manually, before the creation of a new VM

Answer explanation

Azure automatically creates a network security group (NSG) when you create a virtual machine: <name of machine>-nsg, unless an existing one is specified. After creating NSG rules, flow logs can be created. Flow logs are the source of truth for all network activity in your cloud environment and are a "must have" for any investigation.

In Azure, what is the name of an object that represents an entity which can access a resource?

• Security principal

• Binding

• Organizational resource

• ARN

Answer explanation

Azure role-based access control (RBAC) lets you manage who has access to what resource and what they can do with that resource. Azure RBAC is an authorization system built on Azure Resource Manager. To control access to resources, you create role assignments. There are three elements to a role assignment:

1. Security principal – An object representing an entity such as a user or group, which can access the resource
2. Role definition – A collection of permissions such as read, write, and delete
3. Scope – Specifies which role can access a resource or resource group; scopes can be specified at four levels: management group, subscription, resource group, resource

Where would an engineer configure logs to be sent to a Log Analytics workspace within the Azure Active Directory service for correlation?

• Audit logs

• Sign-ins

• Diagnostic settings

• Provisioning logs

Answer explanation

While the portal is convenient for a quick search, it is very limited. The real power is in the Log Analytics workspace. The best solution is to send most relevant log types, including Azure Active Directory (AAD) logs, to the Log Analytics workspace. This provides a single location to see all your logs, which is very convenient.

For the AAD logs, you will need to complete the following steps in the Azure portal:

• Step 1: Search for and select the "Azure Active Directory" service
• Step 2: On the left menu, select "Diagnostic settings"
• Step 3: Select "Add diagnostic setting"

When investigating brute-force attempts in SOF-ELK, which sign-in log field should you check for the Azure Active Directory name of the user?

• useragent

• user_name

• user_principal_name

• user_id

Answer explanation

The user_principal_name field includes the Azure Active Directory (AAD) name of the login user, which is critical to include in detection methods but also useful for identifying the account used for specific actions.

Which kind of storage should you pick to store a snapshot of an Azure VM?

• The fastest SSD

• The fastest HDD

• A standard HDD

• A standard SSD

Answer explanation

When creating a snapshot, you can pick the cheapest standard HDD storage option. There is no need for a premium SSD because you will not be running forensic tools against the snapshot directly.

Which operation should be reviewed in the StorageRead log while investigating a suspected data exfiltration incident?

• CopyResource

• GetBlob

• StorageWrite

• StorageDelete

Answer explanation

There are a large number of actions tracked in the operationName field in the StorageRead log, but for the purpose of tracking data exfiltration, you should focus on the GetBlob operation.

While reviewing activity logs during an incident, which operations should be reviewed to determine whether a compromised account might have enumerated storage credentials in Azure?

• VIRTUALMACHINES/WRITE

• IPADDRESS/DELETE

• LISTKEYS/ACTION

• SECURITYRULES/READ

Answer explanation

When investigating an incident, you should look for LISTKEYS/ACTION operations to find whether any principal has enumerated the storage credentials.

If your investigation requires a large amount of data from Azure and an in-cloud investigation is not possible, what service can you use?

• 
  

• VMCloud forensic capture

• Azure import/export service

• Azure Imager

• Cloud forensicator

Answer explanation

In most situations, an in-cloud investigation is the most efficient option. However, if you are facing an investigation requiring a large amount of data from Azure, you can use the Azure Import/Export service to request those data.

In Azure, how is Microsoft.compute classified?

• Reference

• Resource group

• Resource

• Resource provider

Answer explanation

A resource provider is a service that supplies the resources you can deploy and manage through the Resource Manager. For example, if you want to deploy a virtual machine, the Microsoft.compute resource provider will be invoked. Similarly, a storage account will invoke the Microsoft.storage resource provider.