SC-200 Network Security Fundamentals 3

Question 1

Which network security control inspects encrypted HTTPS traffic to detect threats hidden within TLS sessions?

Accepted Answer

TLS/SSL inspection (deep packet inspection)

Answer

TLS/SSL inspection decrypts, inspects, and re-encrypts traffic to allow security appliances to detect malware and data exfiltration inside HTTPS.

Question 2

What does a high volume of failed authentication attempts followed by a single successful login from the same external IP most likely indicate?

Accepted Answer

Credential stuffing or brute-force attack

Answer

Many failed logins followed by one success is the classic signature of a brute-force or credential stuffing attack achieving eventual access.

Question 3

Which Azure service provides distributed denial-of-service (DDoS) protection for resources deployed in Azure virtual networks?

Accepted Answer

Azure DDoS Protection

Answer

Azure DDoS Protection (Standard tier) provides always-on monitoring and automatic attack mitigation for Azure virtual network resources.

Question 4

An attacker uses a compromised host to pivot to other internal systems without generating external traffic. Which Defender for Endpoint feature helps detect this lateral movement?

Accepted Answer

Endpoint detection and response (EDR) behavioral sensors

Answer

EDR behavioral sensors continuously monitor process activity, network connections, and file events to detect lateral movement techniques on endpoints.

Question 5

Which MITRE ATT&CK tactic describes an adversary's attempt to avoid detection while maintaining access to a network?

Accepted Answer

Defense Evasion

Answer

Defense Evasion encompasses techniques adversaries use to avoid detection, such as disabling security tools, obfuscating code, or clearing logs.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Network Security Fundamentals 3