Courseiva
Application, Email and Cloud ForensicsmediumMultiple ChoiceObjective-mapped

Azure Activity Log for VM Deletion Investigation

Which Azure log source should an investigator query to identify who deleted a virtual machine and when?

Quick Answer

The correct answer is the Azure Activity Log, now known as the Monitor Activity Log. This log source is the definitive record for all control-plane operations in Azure, including the deletion of a virtual machine, because it captures who performed the action, what the action was, and exactly when it occurred. On the Computer Hacking Forensic Investigator CHFI exam, this question tests your ability to distinguish between Azure’s logging layers for forensic investigation—a common trap is confusing the Activity Log with Azure AD sign-in logs, which only track authentication events, or with NSG flow logs, which monitor network traffic. To remember this, think of the Activity Log as the “who, what, when” of resource management: it logs every administrative change to your Azure infrastructure, making it the first place an investigator should query to identify a VM deletion.

⚠ Common exam trap

Candidates often confuse authentication logs (such as sign-in logs) with resource operation logs (such as activity logs). Authentication logs only show login events, not the actions performed after login. To determine who deleted a VM, you need the activity log that records control-plane operations.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Azure Activity Log

The Azure Activity Log (formerly known as Audit Logs) is the subscription-level log that records all control-plane operations on Azure resources, including virtual machine creation, deletion, and modification. When a VM is deleted, the Activity Log captures the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), the caller's identity (user or service principal), the timestamp, and the status of the operation. This makes it the authoritative source for answering 'who deleted a VM and when'.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Azure Activity Log

    Why this is correct

    Activity Log records resource management operations (create, update, delete).

  • Azure Active Directory sign-in logs

    Why it's wrong here

    These logs show sign-in events, not resource operations.

  • Azure Diagnostic Settings for the VM

    Why it's wrong here

    Diagnostic settings log OS-level events, not deletion of the VM itself.

  • Network Security Group flow logs

    Why it's wrong here

    Flow logs capture network traffic, not management operations.

About these practice questions

One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on CHFI

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Which cloud service's audit logs would an investigator examine to identify who deleted a virtual machine in an Azure subscription?

easy
  • A.GCP Audit Logs
  • B.Azure Activity Log
  • C.Azure AD Sign-in Logs
  • D.AWS CloudTrail

Why B: Azure Activity Log (formerly known as Audit Logs or Operational Logs) is the platform-level log that records all control-plane operations for Azure resources, including virtual machine creation, modification, and deletion. When a VM is deleted, the Activity Log captures the caller (user or service principal), the timestamp, the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), and the status. An investigator would query the Activity Log to identify who initiated the deletion, making option B correct.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.