Azure Activity Log for VM Deletion Investigation
Which Azure log source should an investigator query to identify who deleted a virtual machine and when?
Quick Answer
The correct answer is the Azure Activity Log, now known as the Monitor Activity Log. This log source is the definitive record for all control-plane operations in Azure, including the deletion of a virtual machine, because it captures who performed the action, what the action was, and exactly when it occurred. On the Computer Hacking Forensic Investigator CHFI exam, this question tests your ability to distinguish between Azure’s logging layers for forensic investigation—a common trap is confusing the Activity Log with Azure AD sign-in logs, which only track authentication events, or with NSG flow logs, which monitor network traffic. To remember this, think of the Activity Log as the “who, what, when” of resource management: it logs every administrative change to your Azure infrastructure, making it the first place an investigator should query to identify a VM deletion.
⚠ Common exam trap
Candidates often confuse authentication logs (such as sign-in logs) with resource operation logs (such as activity logs). Authentication logs only show login events, not the actions performed after login. To determine who deleted a VM, you need the activity log that records control-plane operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Activity Log
The Azure Activity Log (formerly known as Audit Logs) is the subscription-level log that records all control-plane operations on Azure resources, including virtual machine creation, deletion, and modification. When a VM is deleted, the Activity Log captures the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), the caller's identity (user or service principal), the timestamp, and the status of the operation. This makes it the authoritative source for answering 'who deleted a VM and when'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Activity Log
Why this is correct
Activity Log records resource management operations (create, update, delete).
- ✗
Azure Active Directory sign-in logs
Why it's wrong here
These logs show sign-in events, not resource operations.
- ✗
Azure Diagnostic Settings for the VM
Why it's wrong here
Diagnostic settings log OS-level events, not deletion of the VM itself.
- ✗
Network Security Group flow logs
Why it's wrong here
Flow logs capture network traffic, not management operations.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which cloud service's audit logs would an investigator examine to identify who deleted a virtual machine in an Azure subscription?
easy- A.GCP Audit Logs
- ✓ B.Azure Activity Log
- C.Azure AD Sign-in Logs
- D.AWS CloudTrail
Why B: Azure Activity Log (formerly known as Audit Logs or Operational Logs) is the platform-level log that records all control-plane operations for Azure resources, including virtual machine creation, modification, and deletion. When a VM is deleted, the Activity Log captures the caller (user or service principal), the timestamp, the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), and the status. An investigator would query the Activity Log to identify who initiated the deletion, making option B correct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.