SC-200 Cryptography & Encryption 3

Question 1

An SC-200 analyst investigates a ransomware incident where files have the extension .encrypted. The ransom note claims RSA-2048 was used. What does this imply about the decryption process?

Accepted Answer

The private RSA key held by the attacker is required to decrypt the symmetric key used for file encryption

Answer

Decryption requires a symmetric key that was generated locally

Answer

All files can be decrypted using the public key from the certificate

Answer

RSA-2048 is weak enough to brute-force given sufficient compute

Question 2

Which Microsoft Sentinel data connector ingests Azure Key Vault diagnostic logs to detect unauthorized key access attempts?

Accepted Answer

Azure Key Vault connector via Azure Monitor / Diagnostic Settings

Answer

Microsoft 365 Defender connector

Answer

Azure Activity connector

Answer

Microsoft Defender for Cloud Apps connector

Question 3

A threat hunter writes a KQL query to find processes that load known cryptomining libraries. Which table in Microsoft Defender for Endpoint (via advanced hunting) should they query?

Accepted Answer

DeviceImageLoadEvents

Answer

SecurityAlert

Answer

DeviceNetworkEvents

Answer

EmailAttachmentInfo

Question 4

What is the purpose of certificate pinning in the context of TLS security monitoring?

Accepted Answer

It binds a client to a specific server certificate or public key, preventing MITM via rogue CA certificates

Answer

It forces TLS 1.3 negotiation on all connections

Answer

It pins cipher suites to AES-256-GCM only

Answer

It stores certificate private keys in hardware security modules

Question 5

In Microsoft Entra ID, which authentication method uses asymmetric cryptography where the private key never leaves the device?

Accepted Answer

FIDO2 security keys

Answer

Password hash synchronization

Answer

SMS-based OTP

Answer

Legacy NTLM authentication

Question 6

A security analyst is investigating a data exfiltration alert. The attacker encrypted stolen data using a public key found in a GitHub repository. What attack pattern does this represent?

Accepted Answer

Asymmetric key-based exfiltration (bring-your-own-key)

Answer

Living-off-the-land exfiltration

Answer

DNS tunneling with symmetric encryption

Answer

Steganography-based data hiding

Question 7

Which algorithm is used by Azure Information Protection (Microsoft Purview Information Protection) to encrypt document content?

Accepted Answer

AES-128 or AES-256

Answer

RSA-4096

Answer

3DES

Answer

ChaCha20-Poly1305