SC-200 Cryptography & Encryption 4

Question 1

A Defender for Cloud alert fires for a VM running a process with high CPU consuming on TCP port 3333. What type of attack does this pattern most suggest?

Accepted Answer

Cryptomining (cryptojacking)

Answer

Port 3333 is a common Monero mining pool port, and high CPU usage from an unknown process strongly indicates cryptojacking.

Question 2

When configuring Always Encrypted in Azure SQL Database, where must the Column Encryption Key (CEK) be stored to maintain security?

Accepted Answer

In Azure Key Vault or a local certificate store, never in the database

Answer

Always Encrypted stores only the encrypted CEK value in the database; the plaintext CEK is protected by a Column Master Key kept in a trusted key store like Azure Key Vault.

Question 3

An analyst uses Microsoft Sentinel to hunt for golden ticket attacks. Which cryptographic element does a golden ticket attack forge?

Accepted Answer

The Kerberos TGT signed with the KRBTGT account's NTLM hash

Answer

Golden ticket attacks forge Kerberos Ticket Granting Tickets (TGTs) using the compromised KRBTGT account hash, granting unlimited domain access.

Question 4

Which KQL function in Microsoft Sentinel can be used to extract and decode Base64 strings found in command-line arguments?

Accepted Answer

base64_decode_tostring()

Answer

The base64_decode_tostring() KQL function decodes Base64-encoded data directly within Sentinel queries to reveal obfuscated commands.

Question 5

Microsoft Defender for Office 365 detects an email where the attacker used S/MIME to sign a phishing message with a legitimate-looking certificate. What does S/MIME signing verify?

Accepted Answer

That the sender's identity is bound to a certificate authority-issued certificate

Answer

S/MIME digital signatures use a certificate to authenticate the sender's identity, but do not prevent phishing if the certificate is obtained fraudulently.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Cryptography & Encryption 4