SC-200 Identity & Access Management 3 — Questions and Answers
Question 1: During a threat hunt, an analyst finds that an attacker used Kerberoasting. Which indicator would appear in Defender for Identity alerts?
- Abnormal Kerberos ticket request for a service account with a weak encryption type (Correct answer)
- Pass-the-Ticket activity using a stolen TGT
- NTLM relay attack against a domain controller
- Suspected overpass-the-hash attack
Correct answer: Abnormal Kerberos ticket request for a service account with a weak encryption type
Kerberoasting requests service tickets using RC4 encryption (downgrade), and Defender for Identity flags these abnormal TGS requests targeting service accounts.
Question 2: A Conditional Access policy is set to require a compliant device for all cloud apps. A user on a non-enrolled personal phone is blocked. Which Entra ID feature would allow the user to access only approved apps on that device?
- Azure AD Application Proxy
- App Protection Policies (MAM without enrollment) (Correct answer)
- Hybrid Azure AD Join
- Seamless Single Sign-On
Correct answer: App Protection Policies (MAM without enrollment)
Mobile Application Management (MAM) without device enrollment applies data protection policies to approved apps without requiring full MDM enrollment.
Question 3: Microsoft Defender for Identity raises a 'Suspected Golden Ticket usage' alert. What does this indicate about the attacker's access level?
- The attacker forged a Kerberos TGT using the KRBTGT account hash (Correct answer)
- The attacker captured an NTLM hash from the network
- The attacker used a phished OAuth token to access cloud resources
- The attacker exploited a weak service principal secret
Correct answer: The attacker forged a Kerberos TGT using the KRBTGT account hash
A Golden Ticket attack involves forging a TGT using the KRBTGT hash, giving the attacker persistent, domain-wide Kerberos authentication capabilities.
Question 4: Which Microsoft Sentinel analytic rule would best detect impossible travel sign-ins for Entra ID users?
- A rule checking for sign-ins from blacklisted IP ranges
- A rule correlating two sign-ins from geographically distant locations within a short timeframe (Correct answer)
- A rule alerting on any sign-in outside business hours
- A rule detecting brute-force attempts exceeding 10 failures
Correct answer: A rule correlating two sign-ins from geographically distant locations within a short timeframe
Impossible travel detection correlates sign-in source locations and timestamps to flag authentications that could not physically occur given travel time between locations.
Question 5: An analyst needs to remediate a compromised account in Microsoft Entra ID Protection. Which combination of actions fully remediates the risk?
- Dismiss user risk and unblock the account
- Reset password, revoke all sessions, and confirm user is compromised (Correct answer)
- Enable MFA and dismiss sign-in risk
- Delete and recreate the user account
Correct answer: Reset password, revoke all sessions, and confirm user is compromised
Full remediation requires resetting credentials to evict the attacker, revoking active sessions to terminate existing access, and confirming compromise to feed the risk engine.
Question 6: Which Microsoft Entra ID feature provides just-in-time privileged access with approval workflows and time-limited role assignments?
- Azure AD Roles (permanent assignment)
- Privileged Identity Management (PIM) (Correct answer)
- Entra ID Protection user risk policy
- Administrative Units
Correct answer: Privileged Identity Management (PIM)
PIM enables eligible users to activate privileged roles on-demand with approval workflows and enforces time-limited assignments to reduce standing privilege.
Question 7: A security operations team wants to receive alerts whenever a new Global Administrator is added in their tenant. Which Microsoft Sentinel source provides this data?
- Microsoft Defender for Endpoint via MDE connector
- Microsoft Entra ID AuditLogs via the Azure AD connector (Correct answer)
- Microsoft 365 Defender Incidents API
- Azure Policy compliance logs
Correct answer: Microsoft Entra ID AuditLogs via the Azure AD connector
Entra ID AuditLogs record all administrative changes including role assignments, and the Azure AD connector streams these into Sentinel for alerting.
SC-200 Identity & Access Management 3
During a threat hunt, an analyst finds that an attacker used Kerberoasting.
Which indicator would appear in Defender for Identity alerts?