SC-200 Vulnerability Assessment & Penetration Testing 2

Question 1

A security analyst uses Microsoft Defender Vulnerability Management to prioritize patches. Which metric does the platform's Threat-Based Vulnerability Management feature use to elevate a CVE's priority above its CVSS score alone?

Accepted Answer

Active exploit kit or threat actor activity linked to the CVE

Answer

Threat-Based Vulnerability Management elevates CVE priority when active exploit kits or tracked threat actors are observed exploiting that vulnerability in the wild.

Question 2

During a purple-team exercise, the red team uses Mimikatz to extract NTLM hashes from LSASS memory. Which Microsoft Defender for Endpoint setting, when enabled, prevents this technique without killing the LSASS process?

Accepted Answer

Attack Surface Reduction rule: Block credential stealing from LSASS

Answer

The ASR rule 'Block credential stealing from the Windows local security authority subsystem' (LSASS) blocks attempts to dump credentials from LSASS memory via tools like Mimikatz.

Question 3

An analyst reviews a Microsoft Secure Score recommendation to 'Reduce the attack surface with ASR rules.' Which portal is the primary location to configure and report on Attack Surface Reduction rules in an SC-200 context?

Accepted Answer

Microsoft Defender portal (security.microsoft.com)

Answer

ASR rule configuration, reporting, and per-device mode overrides are managed in the Microsoft Defender portal under Endpoints > Configuration management > Attack surface reduction.

Question 4

A penetration tester discovers an exposed Azure storage account with anonymous blob read access. Which Microsoft Defender for Cloud recommendation would have flagged this misconfiguration before exploitation?

Accepted Answer

Storage account public access should be disallowed

Answer

Defender for Cloud's 'Storage account public access should be disallowed' recommendation flags storage accounts where anonymous blob access is enabled.

Question 5

When running a vulnerability scan with Microsoft Defender Vulnerability Management, an analyst sees a device showing 'Not assessed' for a software component. What is the most likely reason?

Accepted Answer

The device has not been onboarded to Defender for Endpoint

Answer

Devices not onboarded to Microsoft Defender for Endpoint cannot have their software inventory collected, so they appear as 'Not assessed' in Vulnerability Management.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Vulnerability Assessment & Penetration Testing 2