Copying a VM OS Disk Snapshot Across Azure Regions
Robert needs to copy an OS disk snapshot of a compromised VM to a storage account in different region for further investigation. Which of the following should he use in this scenario?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests which Azure interface can programmatically copy a disk snapshot between regions; the trap is picking the Azure Portal GUI, which is not the prescribed scripting method for automated forensic imaging.
In cloud forensics, an investigator must preserve a compromised VM's OS disk snapshot by copying it to a storage account in another region. The correct tool for this scripted, repeatable cross-region copy operation is Azure CLI, which supports snapshot copy commands for forensic acquisition.
Option B (Azure Portal) is the most common wrong pick because the Portal can create snapshots interactively, but the CHFI guidance for duplicating a snapshot to a cross-region storage account specifies command-line tooling rather than GUI clicks.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Azure CLI provides the command-line capability (for example, snapshot/image copy operations) needed to duplicate the compromised VM's OS disk snapshot and place it into a storage account hosted in a different region, which is exactly what Robert must do for off-site forensic preservation. Command-line tooling is scriptable, repeatable, and auditable, so the copy can be logged as part of chain-of-custody evidence handling during a cloud incident. The community discussion reflects this, with alearner citing the ECCouncil CHFI text that instructs the investigator to "copy the snapshot to a storage account under that resource group using Azure CLI".Why the Other Options Are Wrong
Azure Active Directory (now Microsoft Entra ID) is an identity and access control service; it authenticates who may act on resources but performs no data-copying or imaging operations, so it cannot move snapshot data. Azure Portal is a graphical interface used to create or view snapshots, but it is not the scripted, automation-friendly mechanism the CHFI material designates for this cross-region snapshot transfer, and the vote-split commentary showing both Portal and CLI as candidates confirms it as the classic distractor. Azure Monitor is limited to metrics, logs, and alerting on resource health, giving it no snapshot or storage-account data movement function at all.Community Comment Notes
aqeel1506 argues that "Azure CLI provides the necessary commands to manage Azure resources from the command line, including copying snapshots across regions," aligning with the correct choice. 044f354 adds the strongest supporting evidence, quoting the ECCouncil Official CHFI book, Module 12, for the instruction to "copy the snapshot to a storage account under that resource group using Azure CLI". nipunaputha claims "Both answer B and C are correct," but since the exam demands a single best tool for the scripted forensic copy, Portal remains inferior, and ala76nl's terse rationale that "Cli is always prefered" captures the exam's bias toward automatable, repeatable forensic procedures.Official Reference
Exam Strategy
When a question asks which tool performs an action on Azure resources, first separate management-plane interfaces (Portal, CLI, PowerShell) from identity (Entra ID) and observability (Monitor). For forensic acquisition and cross-region copying tasks, default to the scripted option, since CHFI cloud-forensics procedures emphasize repeatable, loggable command-line operations.
Frequently Asked Questions
Why can't Azure Portal be used to copy the snapshot to another region?
Azure Portal can create a snapshot interactively, but the CHFI procedure for duplicating a snapshot into a storage account in another region specifies the scriptable, repeatable Azure CLI command, which also produces an auditable record.
What role does Azure Active Directory play in this snapshot copy?
Azure Active Directory (Entra ID) only authenticates and authorizes Robert's access to the VM and storage account; it does not transfer any snapshot data between regions.