SC-200 Cryptography & Encryption 4

Question 1

A Defender for Cloud alert fires for a VM running a process with high CPU consuming on TCP port 3333. What type of attack does this pattern most suggest?

Accepted Answer

Cryptomining (cryptojacking)

Answer

Ransomware file encryption

Answer

Brute-force password attack

Answer

Data exfiltration via encrypted tunnel

Question 2

When configuring Always Encrypted in Azure SQL Database, where must the Column Encryption Key (CEK) be stored to maintain security?

Accepted Answer

In Azure Key Vault or a local certificate store, never in the database

Answer

In the SQL Server master database

Answer

In the application's config file encrypted with DPAPI

Answer

In the Azure SQL transparent data encryption settings

Question 3

An analyst uses Microsoft Sentinel to hunt for golden ticket attacks. Which cryptographic element does a golden ticket attack forge?

Accepted Answer

The Kerberos TGT signed with the KRBTGT account's NTLM hash

Answer

An AES-256 session key for Kerberos service tickets

Answer

An RSA certificate used for smart card authentication

Answer

A TOTP seed for MFA bypass

Question 4

Which KQL function in Microsoft Sentinel can be used to extract and decode Base64 strings found in command-line arguments?

Accepted Answer

base64_decode_tostring()

Answer

parse_json()

Answer

extract()

Answer

url_decode()

Question 5

Microsoft Defender for Office 365 detects an email where the attacker used S/MIME to sign a phishing message with a legitimate-looking certificate. What does S/MIME signing verify?

Accepted Answer

That the sender's identity is bound to a certificate authority-issued certificate

Answer

That the email content is encrypted end-to-end

Answer

That the email passed SPF and DKIM checks

Answer

That no macros are embedded in attachments

Question 6

A security operations team wants to ensure that Azure Storage encryption keys are rotated automatically. Which Azure feature enables automatic key rotation for Customer-Managed Keys (CMK)?

Accepted Answer

Azure Key Vault key rotation policy with auto-rotate

Answer

Azure Key Vault Firewall policies

Answer

Azure Policy deny initiative for key age

Answer

Microsoft Defender for Key Vault alert rules

Question 7

During incident response, an analyst finds that malware used CryptProtectData (DPAPI) to encrypt stolen credentials before exfiltration. What is significant about DPAPI from a forensics perspective?

Accepted Answer

DPAPI keys are tied to the user/machine context, so decryption requires the victim's credentials or domain backup key

Answer

DPAPI uses a hardcoded global key visible in Windows registry

Answer

DPAPI encrypted blobs can be decrypted by any local administrator

Answer

DPAPI is deprecated and no longer present in Windows 10+