Copying a VM OS Disk Snapshot Across Azure Regions
Short answer
C Azure CLI copies the compromised VM's OS disk snapshot to a storage account in a different region for investigation.
Question
Key Takeaways
The question tests which Azure interface can programmatically copy a disk snapshot between regions; the trap is picking the Azure Portal GUI, which is not the prescribed scripting method for automated forensic imaging.
In cloud forensics, an investigator must preserve a compromised VM's OS disk snapshot by copying it to a storage account in another region. The correct tool for this scripted, repeatable cross-region copy operation is Azure CLI, which supports snapshot copy commands for forensic acquisition.
Common mistake: Option B (Azure Portal) is the most common wrong pick because the Portal can create snapshots interactively, but the CHFI guidance for duplicating a snapshot to a cross-region storage account specifies command-line tooling rather than GUI clicks.
Expert Analysis
Why the Answer Is Correct
Azure CLI provides the command-line capability (for example, snapshot/image copy operations) needed to duplicate the compromised VM's OS disk snapshot and place it into a storage account hosted in a different region, which is exactly what Robert must do for off-site forensic preservation. Command-line tooling is scriptable, repeatable, and auditable, so the copy can be logged as part of chain-of-custody evidence handling during a cloud incident. The community discussion reflects this, with alearner citing the ECCouncil CHFI text that instructs the investigator to "copy the snapshot to a storage account under that resource group using Azure CLI".
Why the Other Options Are Wrong
Azure Active Directory (now Microsoft Entra ID) is an identity and access control service; it authenticates who may act on resources but performs no data-copying or imaging operations, so it cannot move snapshot data. Azure Portal is a graphical interface used to create or view snapshots, but it is not the scripted, automation-friendly mechanism the CHFI material designates for this cross-region snapshot transfer, and the vote-split commentary showing both Portal and CLI as candidates confirms it as the classic distractor. Azure Monitor is limited to metrics, logs, and alerting on resource health, giving it no snapshot or storage-account data movement function at all.
Community Comment Notes
aqeel1506 argues that "Azure CLI provides the necessary commands to manage Azure resources from the command line, including copying snapshots across regions," aligning with the correct choice. 044f354 adds the strongest supporting evidence, quoting the ECCouncil Official CHFI book, Module 12, for the instruction to "copy the snapshot to a storage account under that resource group using Azure CLI". nipunaputha claims "Both answer B and C are correct," but since the exam demands a single best tool for the scripted forensic copy, Portal remains inferior, and ala76nl's terse rationale that "Cli is always prefered" captures the exam's bias toward automatable, repeatable forensic procedures.
Official Reference
https://learn.microsoft.com/en-us/cli/azure/snapshot
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question asks which tool performs an action on Azure resources, first separate management-plane interfaces (Portal, CLI, PowerShell) from identity (Entra ID) and observability (Monitor). For forensic acquisition and cross-region copying tasks, default to the scripted option, since CHFI cloud-forensics procedures emphasize repeatable, loggable command-line operations.
Frequently Asked Questions
Why can't Azure Portal be used to copy the snapshot to another region?
What role does Azure Active Directory play in this snapshot copy?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
aqeel1506 👍 2C. Azure CLI Robert should use Azure CLI (Command-Line Interface) to copy an OS disk snapshot of a compromised VM to a storage account in a different region for further investigation. Azure CLI provides the necessary commands to manage Azure resources from the command line, including copying snapshots across regions. This information is aligned with best practices and would be consistent with the details found in the CHFI v10 textbook.
-
Elb 👍 2Create a Snapshot of the OS Disk of the Affected VM via Azure Portal Create a Snapshot of the OS Disk of the Affected VM via Azure CLI
-
nipunaputha 👍 2Both answer B and C are correct
-
044f354 👍 1 Answered C"copy the snapshot to a storage account under that resource group using Azure CLI" ECCouncil Official CHFI https://bookshelf.vitalsource.com/reader/books/9781635676969/ Module 12 Page 1187
-
ala76nl 👍 3 Answered CCli is always prefered
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.