SC-200 Cryptography & Encryption 5

Question 1

An SC-200 analyst reviews a Defender for Endpoint alert about a process calling BCryptEncrypt with a hardcoded key. What security concern does hardcoding encryption keys represent?

Accepted Answer

It prevents key rotation and exposes the key to static analysis or binary extraction

Answer

Hardcoded keys cannot be rotated and can be extracted through reverse engineering, making the encryption trivially breakable.

Question 2

Which Microsoft Purview feature uses encryption to restrict who can access sensitive documents even after they are downloaded outside the organization?

Accepted Answer

Microsoft Purview Information Protection sensitivity labels with encryption

Answer

Sensitivity labels in Microsoft Purview can apply AES encryption and usage rights that persist with the document regardless of where it is stored.

Question 3

A threat actor uses RC4 encryption in a malware C2 communication protocol. Why is RC4 considered cryptographically weak?

Accepted Answer

RC4 has known statistical biases in its keystream making ciphertext vulnerable to analysis

Answer

RC4's keystream has statistical biases (especially in early bytes) that allow attackers to recover plaintext or keys through cryptanalysis.

Question 4

When Microsoft Sentinel detects unusual Azure Key Vault operations, which audit log event should analysts focus on to identify unauthorized secret access?

Accepted Answer

AzureDiagnostics | where ResourceType == 'VAULTS' and ResultType == 'Success' and OperationName == 'SecretGet'

Answer

SecretGet operations in AzureDiagnostics for Key Vault vaults reveal when secrets were successfully retrieved, helping identify unauthorized access.

Question 5

An analyst investigates a Silver Ticket attack against a SQL Server service. Which cryptographic secret is compromised in a Silver Ticket attack, compared to a Golden Ticket?

Accepted Answer

The target service account's NTLM hash or AES key, not the KRBTGT hash

Answer

Silver Tickets forge service tickets using the service account's hash — they don't require the KRBTGT key but are scoped to one service.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Cryptography & Encryption 5