SC-200 Network Security Fundamentals 3 — Questions and Answers
Question 1: Which network security control inspects encrypted HTTPS traffic to detect threats hidden within TLS sessions?
- Network Access Control (NAC)
- TLS/SSL inspection (deep packet inspection) (Correct answer)
- BGP route filtering
- 802.1X port authentication
Correct answer: TLS/SSL inspection (deep packet inspection)
TLS/SSL inspection decrypts, inspects, and re-encrypts traffic to allow security appliances to detect malware and data exfiltration inside HTTPS.
Question 2: What does a high volume of failed authentication attempts followed by a single successful login from the same external IP most likely indicate?
- Credential stuffing or brute-force attack (Correct answer)
- Insider threat from a privileged user
- DNS hijacking
- ARP spoofing attack
Correct answer: Credential stuffing or brute-force attack
Many failed logins followed by one success is the classic signature of a brute-force or credential stuffing attack achieving eventual access.
Question 3: Which Azure service provides distributed denial-of-service (DDoS) protection for resources deployed in Azure virtual networks?
- Azure Front Door
- Azure DDoS Protection (Correct answer)
- Azure Firewall Premium
- Azure Application Gateway WAF
Correct answer: Azure DDoS Protection
Azure DDoS Protection (Standard tier) provides always-on monitoring and automatic attack mitigation for Azure virtual network resources.
Question 4: An attacker uses a compromised host to pivot to other internal systems without generating external traffic. Which Defender for Endpoint feature helps detect this lateral movement?
- Microsoft Secure Score
- Automated investigation and remediation (AIR)
- Endpoint detection and response (EDR) behavioral sensors (Correct answer)
- Application Guard
Correct answer: Endpoint detection and response (EDR) behavioral sensors
EDR behavioral sensors continuously monitor process activity, network connections, and file events to detect lateral movement techniques on endpoints.
Question 5: Which MITRE ATT&CK tactic describes an adversary's attempt to avoid detection while maintaining access to a network?
- Initial Access
- Defense Evasion (Correct answer)
- Persistence
- Lateral Movement
Correct answer: Defense Evasion
Defense Evasion encompasses techniques adversaries use to avoid detection, such as disabling security tools, obfuscating code, or clearing logs.
Question 6: What does the 'impossible travel' alert in Microsoft Sentinel / Defender for Cloud Apps indicate?
- A user logged in from an expired certificate
- Sign-ins from two geographically distant locations within an impossible timeframe (Correct answer)
- A VPN connection from a blocked country
- Excessive privilege escalation attempts
Correct answer: Sign-ins from two geographically distant locations within an impossible timeframe
Impossible travel detects when a user authenticates from two locations so far apart that physical travel between them in the elapsed time is impossible.
Question 7: Which type of firewall rule controls traffic based on the application identity rather than just port and protocol?
- Stateless packet filter
- Stateful inspection rule
- Next-generation firewall (NGFW) application control (Correct answer)
- Access control list (ACL)
Correct answer: Next-generation firewall (NGFW) application control
NGFW application control uses deep packet inspection to identify applications regardless of port, enabling granular policies based on app identity.
SC-200 Network Security Fundamentals 3
Which network security control inspects encrypted HTTPS traffic to detect threats hidden within TLS sessions?