SC-200 Cryptography & Encryption 2

Question 1

A security analyst notices that TLS 1.0 is still enabled on several Azure App Services. What is the primary risk of allowing TLS 1.0?

Accepted Answer

It is vulnerable to POODLE and BEAST attacks

Answer

It prevents certificate renewal

Answer

It blocks modern cipher suites from negotiating

Answer

It disables HSTS enforcement

Question 2

Which Azure service allows you to enforce minimum TLS version and cipher suite policies across your organization's resources?

Accepted Answer

Azure Policy

Answer

Azure Firewall Policy

Answer

Microsoft Defender for Cloud recommendations

Answer

Azure Key Vault access policies

Question 3

In Microsoft Sentinel, an analyst reviews a KQL query that decodes Base64-encoded PowerShell commands. What cryptographic concept is Base64 encoding?

Accepted Answer

Encoding, not encryption

Answer

Symmetric encryption

Answer

Asymmetric encryption

Answer

Hashing

Question 4

An attacker uses a pass-the-hash attack against NTLM authentication. Which characteristic of NTLM hashes makes this attack possible?

Accepted Answer

NTLM hashes can be used directly as authentication credentials without knowing the plaintext

Answer

NTLM hashes are salted per session

Answer

NTLM uses asymmetric keys for authentication

Answer

NTLM hashes expire after 24 hours

Question 5

A SOC analyst is reviewing Microsoft Defender for Endpoint alerts about suspicious use of certutil.exe. Which malicious cryptographic operation is certutil commonly abused for?

Accepted Answer

Decoding Base64-encoded payloads to drop malware

Answer

Generating RSA key pairs for C2 communication

Answer

Encrypting files with AES before exfiltration

Answer

Creating self-signed TLS certificates for phishing sites

Question 6

Which key type stored in Azure Key Vault is used to wrap (encrypt) other encryption keys, following the envelope encryption pattern?

Accepted Answer

Key Encryption Key (KEK)

Answer

Secret

Answer

Certificate

Answer

Managed Identity

Question 7

Microsoft Defender for Cloud shows a recommendation to enable Azure Disk Encryption on a VM. Which encryption technology does Azure Disk Encryption use on Windows VMs?

Accepted Answer

BitLocker

Answer

VeraCrypt

Answer

LUKS

Answer

FileVault