SC-200 Cryptography & Encryption 3 — Questions and Answers
Question 1: An SC-200 analyst investigates a ransomware incident where files have the extension .encrypted. The ransom note claims RSA-2048 was used. What does this imply about the decryption process?
- Decryption requires a symmetric key that was generated locally
- The private RSA key held by the attacker is required to decrypt the symmetric key used for file encryption (Correct answer)
- All files can be decrypted using the public key from the certificate
- RSA-2048 is weak enough to brute-force given sufficient compute
Correct answer: The private RSA key held by the attacker is required to decrypt the symmetric key used for file encryption
Modern ransomware typically uses RSA to encrypt a per-victim symmetric key; recovery requires the attacker's private RSA key.
Question 2: Which Microsoft Sentinel data connector ingests Azure Key Vault diagnostic logs to detect unauthorized key access attempts?
- Microsoft 365 Defender connector
- Azure Activity connector
- Azure Key Vault connector via Azure Monitor / Diagnostic Settings (Correct answer)
- Microsoft Defender for Cloud Apps connector
Correct answer: Azure Key Vault connector via Azure Monitor / Diagnostic Settings
Azure Key Vault diagnostic logs sent to a Log Analytics workspace via the Key Vault connector enable Sentinel to alert on suspicious key operations.
Question 3: A threat hunter writes a KQL query to find processes that load known cryptomining libraries. Which table in Microsoft Defender for Endpoint (via advanced hunting) should they query?
- SecurityAlert
- DeviceImageLoadEvents (Correct answer)
- DeviceNetworkEvents
- EmailAttachmentInfo
Correct answer: DeviceImageLoadEvents
DeviceImageLoadEvents records DLL and library load events, making it ideal for detecting cryptomining or suspicious module loads.
Question 4: What is the purpose of certificate pinning in the context of TLS security monitoring?
- It forces TLS 1.3 negotiation on all connections
- It binds a client to a specific server certificate or public key, preventing MITM via rogue CA certificates (Correct answer)
- It pins cipher suites to AES-256-GCM only
- It stores certificate private keys in hardware security modules
Correct answer: It binds a client to a specific server certificate or public key, preventing MITM via rogue CA certificates
Certificate pinning ensures the client only trusts a pre-defined certificate or key, blocking attacks that use fraudulent certificates from trusted CAs.
Question 5: In Microsoft Entra ID, which authentication method uses asymmetric cryptography where the private key never leaves the device?
- Password hash synchronization
- FIDO2 security keys (Correct answer)
- SMS-based OTP
- Legacy NTLM authentication
Correct answer: FIDO2 security keys
FIDO2 security keys use public-key cryptography where the private key is stored securely on the device and never transmitted.
Question 6: A security analyst is investigating a data exfiltration alert. The attacker encrypted stolen data using a public key found in a GitHub repository. What attack pattern does this represent?
- Living-off-the-land exfiltration
- Asymmetric key-based exfiltration (bring-your-own-key) (Correct answer)
- DNS tunneling with symmetric encryption
- Steganography-based data hiding
Correct answer: Asymmetric key-based exfiltration (bring-your-own-key)
Using a pre-distributed public key to encrypt exfiltrated data means only the attacker holding the private key can decrypt it — a common APT technique.
Question 7: Which algorithm is used by Azure Information Protection (Microsoft Purview Information Protection) to encrypt document content?
- RSA-4096
- AES-128 or AES-256 (Correct answer)
- 3DES
- ChaCha20-Poly1305
Correct answer: AES-128 or AES-256
Azure Information Protection uses AES (128-bit or 256-bit) for document content encryption, with RSA used to protect the AES key.
SC-200 Cryptography & Encryption 3
An SC-200 analyst investigates a ransomware incident where files have the extension .encrypted.
The ransom note claims RSA-2048 was used.
What does this imply about the decryption process?