NEW
Font size
WorksheetsFORGC2
Total questions: 36
Worksheet time: 18mins
Which WAD table contains the Windows event logs?
WADWindowsEventLogsTable
WADDiagnosticInfrastructureLogsTable
WADPerformaceCountersTable
WADMetricsPT1MPDV2S########
When are network security groups created in Azure?
Automatically, with every VM unless an existing one is specified
Automatically, every night at 3 a.m. ET
Automatically, with every VM
Manually, before the creation of a new VM
In Azure, what is the name of an object that represents an entity which can access a resource?
Security principal
Binding
Organizational resource
ARN
Where would an engineer configure logs to be sent to a Log Analytics workspace within the Azure Active Directory service for correlation?
Audit logs
Sign-ins
Diagnostic settings
Provisioning logs
When investigating brute-force attempts in SOF-ELK, which sign-in log field should you check for the Azure Active Directory name of the user?
useragent
user_name
user_principal_name
user_id
Which kind of storage should you pick to store a snapshot of an Azure VM?
The fastest SSD
The fastest HDD
A standard HDD
A standard SSD
Which operation should be reviewed in the StorageRead log while investigating a suspected data exfiltration incident?
CopyResource
GetBlob
StorageWrite
StorageDelete
While reviewing activity logs during an incident, which operations should be reviewed to determine whether a compromised account might have enumerated storage credentials in Azure?
VIRTUALMACHINES/WRITE
IPADDRESS/DELETE
LISTKEYS/ACTION
SECURITYRULES/READ
If your investigation requires a large amount of data from Azure and an in-cloud investigation is not possible, what service can you use?
VMCloud forensic capture
Azure import/export service
Azure Imager
Cloud forensicator
In Azure, how is Microsoft.compute classified?
Reference
Resource group
Resource
Resource provider
What might prevent an analyst from finding evidence of an attacker’s IP address in network security group (NSG) logs?
The logs were not configured properly.
The Resource Log was not enabled.
NSG logs do not include the source address.
Traffic was blocked using a deny rule.
What happens when an Azure Resource Group is deleted?
Only the group’s VMs will be deleted
All resources within the group will be deleted except for the VMs.
All resources within the group will be deleted.
The resources within the group will not be deleted.
Which PowerShell command will install the proper module to connect to Azure?
Import-Module Az -NoClobber
Install-Module -Name Az -AllowClobber
Connect-AzAccount
Get-Module Az
What solution is available for an enterprise that wants to send Azure logs in real-time to a non-Azure destination such as a SIEM?
Log Analytics
Event hub
Azure Portal
Storage account
Which Azure Windows Agent is able to write data to a storage account or an event hub?
Dependency Extension
Diagnostics Extension
Log Analytics Agent
Azure Monitor Agent
An analyst reviews the Activity log in the Azure portal and decides to download the data as a CSV for offline review. What should they keep in mind when performing this operation?
CSV does not include all schema details.
CSV is often corrupt on export.
JSON is more useful in the portal.
JSON and CSV exports contain all the same data in different formats.
Which Azure Windows agent can be installed to collect network connection metrics?
Dependency Agent
Log Analytics Agent
Diagnostics Extension
Azure Monitor Agent
Which method of accessing Azure creates a file containing evidence of issued commands?
Web Portal
PowerShell
Graph API
Azure CLI
Which kind of storage should be used when creating a VM to conduct forensics on a snapshot in Azure?
The fastest SSD
A standard SSD
A standard HDD
The fastest HDD
What is important to remember about an evidence disk snapshot that will be analyzed with an in-cloud forensic VM in Azure?
The snapshot disk should be mounted as an OS disk.
The snapshot disk can be deleted.
The snapshot disk should be mounted as a data disk.
The snapshot disk is optional.
Which table would provide an analyst with login information on a Linux virtual machine using Azure Storage Explorer?
LinuxSyslogVer2v0
/var/log/kern.log
VM Insights
syslog_progam
What statement can be used in Azure Log Analytics to provide a count of each operation, similar to an Excel pivot table?
distinct count (field)
eventstats
summarize count() by
measure-object()
What resource does Microsoft provide that includes detailed explanations of the tactics and techniques adversaries use when attacking Azure?
Azure Incident Response Playbooks
Azure Threat Research Matrix
Microsoft Attacker Framework
Microsoft Incident Response Guide
During an investigation, a new Azure security administrator explains that the organization has not set up an event hub to send data to their external SIEM, but logs appear to be aggregated for correlation. What alternative method might have been used?
Graph API
CloudTrail
Log Analytics
GuardDuty
An investigator reviews tenant logs to find new Graph API applications being created. What is the most likely reason that there is no logging for hours 16 and 17 in the output below?
tenantId=7e325eda-7945-46d3-ac99-f0dcfeb4628e\
y=2021\m=03\d=20\h=15\m=00\PT1H.json
y=2021\m=03\d=20\h=18\m=00\PT1H.json
PT1H.json files were not created due to logging errors.
PT1H.json files were deleted by a malicious actor.
PT1H.json files are only created when there are log data.
PT1H.json files are sent to a storage account and deleted.
Which Azure logs are turned on by default?
Subscription and tenant logs
Application and resource logs
Tenant and operating system logs
Resource and operating system logs
What limitation should investigators consider when reviewing sign-in logs via the Azure portal?
Logs cannot be accessed via the portal.
Logs are rotated based on size.
Logs are often truncated.
Logs are stored for 30 days.
Through which interface can Microsoft Azure be accessed via various programming languages, such as PHP, Python, and Node.js?
Azure CLI
Azure SDK
Graph API
Web Portal
Which type of binary large object (BLOB) is ideal for log storage in Microsoft Azure?
Append blobs
Page blobs
Log blobs
Block blobs
What is a consequence of Azure public IP addresses being NATed?
Logs will show the VM's private IP address only
Logs will show both the private and public IP addresses.
Logs will show the VM's public IP address only.
Multiple regions may need to be analyzed for VMs in the same VNet.
Which Azure Subscription log field can be used to track the sequence of events that comprise a specific operation for further investigation?
resultSignature
operationName
correlationId
actionPerformed
What feature is crucial to imaging a drive in a cloud environment during an investigation?
Replicator
Clone
Snapshot
Backup
When enabling NSG flow logs, what is the benefit of selecting version 2 vs. version 1?
Transport layer information is captured.
Logs are written in JSON format.
Logs are retained for one year.
Throughput information is captured.
What feature can an adversary use to execute PowerShell or Bash scripts on an Azure VM without logging into the machine?
Sentinel
Run Command
AzCopy
Graph API
What log type should be reviewed to determine whether a password spray attack was conducted or was successful?
Subscription
Tenant
Resource
Application
What are the three elements of a role assignment that control access to Azure resources?
User/group membership, access control list, and role context
Security principal, role definition, and scope
User/group membership, role definition, and role context
Security principal, access control list, and scope
