SC-200 Network Security Fundamentals 2

Question 1

A SOC analyst notices that an internal host is sending DNS queries to an external server every 60 seconds with unusually long subdomains. What attack technique does this most likely indicate?

Accepted Answer

DNS tunneling for C2 communication

Answer

Regular beaconing with encoded data in DNS subdomains is a hallmark of DNS tunneling used for command-and-control (C2) communication.

Question 2

Which Azure Sentinel (Microsoft Sentinel) feature automatically maps detected threats to the MITRE ATT&CK framework?

Accepted Answer

Analytics rule templates

Answer

Analytics rule templates in Microsoft Sentinel include MITRE ATT&CK tactic and technique mappings to help analysts contextualize alerts.

Question 3

What is the primary purpose of network segmentation in a Zero Trust architecture?

Accepted Answer

Limit lateral movement by isolating workloads

Answer

Micro-segmentation limits the blast radius of a breach by preventing attackers from moving laterally between isolated network zones.

Question 4

An analyst observes many ICMP echo requests from one internal host to hundreds of different IP addresses in rapid succession. What does this behavior most likely indicate?

Accepted Answer

Network ping sweep / reconnaissance

Answer

Rapid ICMP echo requests to a wide range of IPs is characteristic of a ping sweep used for host discovery during reconnaissance.

Question 5

In Microsoft Defender for Endpoint, which capability detects anomalous network connections made by processes on an endpoint?

Accepted Answer

Network protection

Answer

Network protection in Defender for Endpoint blocks endpoints from connecting to malicious IPs, domains, and URLs at the network layer.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Network Security Fundamentals 2