SC-200 Network Security Fundamentals 2 — Questions and Answers
Question 1: A SOC analyst notices that an internal host is sending DNS queries to an external server every 60 seconds with unusually long subdomains. What attack technique does this most likely indicate?
- DNS amplification attack
- DNS tunneling for C2 communication (Correct answer)
- DNS cache poisoning
- DNS zone transfer abuse
Correct answer: DNS tunneling for C2 communication
Regular beaconing with encoded data in DNS subdomains is a hallmark of DNS tunneling used for command-and-control (C2) communication.
Question 2: Which Azure Sentinel (Microsoft Sentinel) feature automatically maps detected threats to the MITRE ATT&CK framework?
- Workbooks
- Fusion ML detections
- Analytics rule templates (Correct answer)
- Entity behavior analytics
Correct answer: Analytics rule templates
Analytics rule templates in Microsoft Sentinel include MITRE ATT&CK tactic and technique mappings to help analysts contextualize alerts.
Question 3: What is the primary purpose of network segmentation in a Zero Trust architecture?
- Improve network throughput
- Limit lateral movement by isolating workloads (Correct answer)
- Reduce the number of firewall rules
- Enable split-tunneling for VPN users
Correct answer: Limit lateral movement by isolating workloads
Micro-segmentation limits the blast radius of a breach by preventing attackers from moving laterally between isolated network zones.
Question 4: An analyst observes many ICMP echo requests from one internal host to hundreds of different IP addresses in rapid succession. What does this behavior most likely indicate?
- Normal network health check
- Network ping sweep / reconnaissance (Correct answer)
- DDoS amplification attack
- BGP route injection
Correct answer: Network ping sweep / reconnaissance
Rapid ICMP echo requests to a wide range of IPs is characteristic of a ping sweep used for host discovery during reconnaissance.
Question 5: In Microsoft Defender for Endpoint, which capability detects anomalous network connections made by processes on an endpoint?
- Attack Surface Reduction (ASR) rules
- Network protection (Correct answer)
- Web content filtering
- Controlled folder access
Correct answer: Network protection
Network protection in Defender for Endpoint blocks endpoints from connecting to malicious IPs, domains, and URLs at the network layer.
Question 6: Which protocol is most commonly abused for lateral movement because it allows remote command execution and is often permitted inside corporate networks?
- FTP
- SNMP
- SMB/WMI (Correct answer)
- LDAP
Correct answer: SMB/WMI
SMB (for file shares and PsExec-style execution) and WMI are widely used for legitimate administration and are therefore frequently abused for lateral movement.
Question 7: A Microsoft Sentinel analytics rule generates too many false positives for a legitimate admin tool. What is the best first step to reduce noise without disabling the rule?
- Delete the analytics rule
- Add an exclusion/entity filter to the rule query (Correct answer)
- Increase the query frequency
- Lower the alert severity to Informational
Correct answer: Add an exclusion/entity filter to the rule query
Adding exclusion filters (e.g., whitelisting known admin accounts or IPs) in the KQL query refines detections without fully disabling the rule.
SC-200 Network Security Fundamentals 2
A SOC analyst notices that an internal host is sending DNS queries to an external server every 60 seconds with unusually long subdomains.
What attack technique does this most likely indicate?