SC-200 Cryptography & Encryption 2 — Questions and Answers
Question 1: A security analyst notices that TLS 1.0 is still enabled on several Azure App Services. What is the primary risk of allowing TLS 1.0?
- It prevents certificate renewal
- It is vulnerable to POODLE and BEAST attacks (Correct answer)
- It blocks modern cipher suites from negotiating
- It disables HSTS enforcement
Correct answer: It is vulnerable to POODLE and BEAST attacks
TLS 1.0 is susceptible to known attacks like POODLE and BEAST, making it insecure for protecting data in transit.
Question 2: Which Azure service allows you to enforce minimum TLS version and cipher suite policies across your organization's resources?
- Azure Firewall Policy
- Azure Policy (Correct answer)
- Microsoft Defender for Cloud recommendations
- Azure Key Vault access policies
Correct answer: Azure Policy
Azure Policy can enforce compliance rules including minimum TLS version requirements across subscriptions and resource groups.
Question 3: In Microsoft Sentinel, an analyst reviews a KQL query that decodes Base64-encoded PowerShell commands. What cryptographic concept is Base64 encoding?
- Symmetric encryption
- Asymmetric encryption
- Encoding, not encryption (Correct answer)
- Hashing
Correct answer: Encoding, not encryption
Base64 is an encoding scheme that represents binary data as ASCII text — it provides no confidentiality and is not encryption.
Question 4: An attacker uses a pass-the-hash attack against NTLM authentication. Which characteristic of NTLM hashes makes this attack possible?
- NTLM hashes are salted per session
- NTLM hashes can be used directly as authentication credentials without knowing the plaintext (Correct answer)
- NTLM uses asymmetric keys for authentication
- NTLM hashes expire after 24 hours
Correct answer: NTLM hashes can be used directly as authentication credentials without knowing the plaintext
NTLM hashes function as authentication tokens, so possessing the hash alone allows an attacker to authenticate without cracking it.
Question 5: A SOC analyst is reviewing Microsoft Defender for Endpoint alerts about suspicious use of certutil.exe. Which malicious cryptographic operation is certutil commonly abused for?
- Generating RSA key pairs for C2 communication
- Decoding Base64-encoded payloads to drop malware (Correct answer)
- Encrypting files with AES before exfiltration
- Creating self-signed TLS certificates for phishing sites
Correct answer: Decoding Base64-encoded payloads to drop malware
Threat actors abuse certutil.exe's -decode flag to convert Base64-encoded malware payloads into executable files on disk.
Question 6: Which key type stored in Azure Key Vault is used to wrap (encrypt) other encryption keys, following the envelope encryption pattern?
- Secret
- Certificate
- Key Encryption Key (KEK) (Correct answer)
- Managed Identity
Correct answer: Key Encryption Key (KEK)
A Key Encryption Key (KEK) encrypts Data Encryption Keys (DEKs), implementing envelope encryption to protect key material.
Question 7: Microsoft Defender for Cloud shows a recommendation to enable Azure Disk Encryption on a VM. Which encryption technology does Azure Disk Encryption use on Windows VMs?
- VeraCrypt
- BitLocker (Correct answer)
- LUKS
- FileVault
Correct answer: BitLocker
Azure Disk Encryption leverages BitLocker on Windows VMs to encrypt OS and data disks, with keys stored in Azure Key Vault.
SC-200 Cryptography & Encryption 2
A security analyst notices that TLS 1.0 is still enabled on several Azure App Services.
What is the primary risk of allowing TLS 1.0?