Identify the next step in the investigation of the security incident in Azure?

An IT company uses two resource groups, named Production-group and Security-group, under the same subscription ID. Under the Production-group, a VM called Ubuntu18 is suspected to be compromised. As a forensic investigator, you need to take a snapshot (ubuntudisksnap) of the OS disk of the suspect virtual machine Ubuntu18 for further investigation and copy the snapshot to a storage account under Security-group.

Identify the next step in the investigation of the security incident in Azure?
A . Copy the snapshot to file share
B . Generate shared access signature
C . Create a backup copy of snapshot in a blob container
D . Mount the snapshot onto the forensic workstation

View Answer

Answer: B

Explanation:

When an IT company suspects that a VM called Ubuntu18 in the Production-group has been compromised, it is essential to perform a forensic investigation. The process of taking a snapshot and ensuring its integrity and accessibility involves several steps: