SC-200 Cryptography & Encryption 2

Question 1

A security analyst notices that TLS 1.0 is still enabled on several Azure App Services. What is the primary risk of allowing TLS 1.0?

Accepted Answer

It is vulnerable to POODLE and BEAST attacks

Answer

TLS 1.0 is susceptible to known attacks like POODLE and BEAST, making it insecure for protecting data in transit.

Question 2

Which Azure service allows you to enforce minimum TLS version and cipher suite policies across your organization's resources?

Accepted Answer

Azure Policy

Answer

Azure Policy can enforce compliance rules including minimum TLS version requirements across subscriptions and resource groups.

Question 3

In Microsoft Sentinel, an analyst reviews a KQL query that decodes Base64-encoded PowerShell commands. What cryptographic concept is Base64 encoding?

Accepted Answer

Encoding, not encryption

Answer

Base64 is an encoding scheme that represents binary data as ASCII text — it provides no confidentiality and is not encryption.

Question 4

An attacker uses a pass-the-hash attack against NTLM authentication. Which characteristic of NTLM hashes makes this attack possible?

Accepted Answer

NTLM hashes can be used directly as authentication credentials without knowing the plaintext

Answer

NTLM hashes function as authentication tokens, so possessing the hash alone allows an attacker to authenticate without cracking it.

Question 5

A SOC analyst is reviewing Microsoft Defender for Endpoint alerts about suspicious use of certutil.exe. Which malicious cryptographic operation is certutil commonly abused for?

Accepted Answer

Decoding Base64-encoded payloads to drop malware

Answer

Threat actors abuse certutil.exe's -decode flag to convert Base64-encoded malware payloads into executable files on disk.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Cryptography & Encryption 2