SC-200 Vulnerability Assessment & Penetration Testing 2 — Questions and Answers
Question 1: A security analyst uses Microsoft Defender Vulnerability Management to prioritize patches. Which metric does the platform's Threat-Based Vulnerability Management feature use to elevate a CVE's priority above its CVSS score alone?
- Asset value tag assigned by the administrator
- Active exploit kit or threat actor activity linked to the CVE (Correct answer)
- Number of affected devices across the tenant
- Patch release date from the vendor
Correct answer: Active exploit kit or threat actor activity linked to the CVE
Threat-Based Vulnerability Management elevates CVE priority when active exploit kits or tracked threat actors are observed exploiting that vulnerability in the wild.
Question 2: During a purple-team exercise, the red team uses Mimikatz to extract NTLM hashes from LSASS memory. Which Microsoft Defender for Endpoint setting, when enabled, prevents this technique without killing the LSASS process?
- Credential Guard
- Attack Surface Reduction rule: Block credential stealing from LSASS (Correct answer)
- Windows Defender Antivirus real-time protection
- Microsoft Defender SmartScreen
Correct answer: Attack Surface Reduction rule: Block credential stealing from LSASS
The ASR rule 'Block credential stealing from the Windows local security authority subsystem' (LSASS) blocks attempts to dump credentials from LSASS memory via tools like Mimikatz.
Question 3: An analyst reviews a Microsoft Secure Score recommendation to 'Reduce the attack surface with ASR rules.' Which portal is the primary location to configure and report on Attack Surface Reduction rules in an SC-200 context?
- Microsoft Entra admin center
- Microsoft Defender portal (security.microsoft.com) (Correct answer)
- Microsoft Intune admin center
- Azure Policy compliance blade
Correct answer: Microsoft Defender portal (security.microsoft.com)
ASR rule configuration, reporting, and per-device mode overrides are managed in the Microsoft Defender portal under Endpoints > Configuration management > Attack surface reduction.
Question 4: A penetration tester discovers an exposed Azure storage account with anonymous blob read access. Which Microsoft Defender for Cloud recommendation would have flagged this misconfiguration before exploitation?
- Enable Microsoft Defender for Storage
- Storage account public access should be disallowed (Correct answer)
- Enable soft delete for blobs
- Require secure transfer to storage accounts
Correct answer: Storage account public access should be disallowed
Defender for Cloud's 'Storage account public access should be disallowed' recommendation flags storage accounts where anonymous blob access is enabled.
Question 5: When running a vulnerability scan with Microsoft Defender Vulnerability Management, an analyst sees a device showing 'Not assessed' for a software component. What is the most likely reason?
- The device has not been onboarded to Defender for Endpoint (Correct answer)
- The software is not in the Microsoft vulnerability database
- The device's MDE sensor is in passive mode
- The device operating system is unsupported for software inventory
Correct answer: The device has not been onboarded to Defender for Endpoint
Devices not onboarded to Microsoft Defender for Endpoint cannot have their software inventory collected, so they appear as 'Not assessed' in Vulnerability Management.
Question 6: A red team operator uses PowerShell to download and execute a second-stage payload from a remote URL using IEX (Invoke-Expression). Which Microsoft Defender for Endpoint capability is specifically designed to detect and block this AMSI-bypassing technique?
- Behavior monitoring
- Script scanning via AMSI integration (Correct answer)
- Network protection
- Controlled folder access
Correct answer: Script scanning via AMSI integration
AMSI (Antimalware Scan Interface) integration allows Defender to scan in-memory PowerShell content at runtime, catching obfuscated or dynamically constructed scripts before execution.
Question 7: During a penetration test debrief, the client asks about 'exposure score' in Microsoft Defender Vulnerability Management. What does a high exposure score indicate?
- The organization has many internet-facing assets
- The organization's devices are at high risk due to unpatched vulnerabilities and misconfigurations (Correct answer)
- More than 50% of devices have failed compliance checks
- The tenant has exceeded its licensed device count
Correct answer: The organization's devices are at high risk due to unpatched vulnerabilities and misconfigurations
A high exposure score in Defender Vulnerability Management indicates that the organization's devices collectively have significant unpatched vulnerabilities and security misconfigurations that increase breach risk.
SC-200 Vulnerability Assessment & Penetration Testing 2
A security analyst uses Microsoft Defender Vulnerability Management to prioritize patches.
Which metric does the platform's Threat-Based Vulnerability Management feature use to elevate a CVE's priority above its CVSS score alone?