SC-200 Vulnerability Assessment & Penetration Testing 3 — Questions and Answers
Question 1: An analyst uses Defender for Cloud's regulatory compliance dashboard and sees a control failing under the NIST SP 800-53 benchmark. The failing check is 'Vulnerabilities in security configuration on your machines should be remediated.' Which underlying technology provides the raw assessment data for this check?
- Azure Policy guest configuration (Correct answer)
- Microsoft Defender Vulnerability Management agent
- Log Analytics workspace security events
- Microsoft Entra ID Protection risk detections
Correct answer: Azure Policy guest configuration
Azure Policy guest configuration (formerly Azure Automation DSC) assesses OS-level security configuration baselines and feeds that data into Defender for Cloud's compliance controls.
Question 2: A penetration tester successfully pivots from a compromised Azure VM to an Azure SQL database using a managed identity token. Which Defender for Cloud feature would have detected this lateral movement attempt in real time?
- Microsoft Defender for SQL — threat detection alert for anomalous access (Correct answer)
- Azure Sentinel scheduled analytics rule on AuditLogs
- Defender for Servers file integrity monitoring
- Azure AD Conditional Access policy violation alert
Correct answer: Microsoft Defender for SQL — threat detection alert for anomalous access
Microsoft Defender for SQL generates real-time threat detection alerts for anomalous access patterns, including access from unusual compute resources like a VM that normally doesn't query the database.
Question 3: A security engineer wants to run authenticated vulnerability scans against network devices that cannot have the MDE sensor installed. Which Defender Vulnerability Management feature supports agentless scanning for these devices?
- Device discovery with basic mode
- Network device scanning with a designated scanner device (Correct answer)
- Microsoft Defender for IoT passive monitoring
- Azure Arc-enabled server extension
Correct answer: Network device scanning with a designated scanner device
Defender Vulnerability Management's network device scanning feature uses a designated MDE-onboarded device to perform credentialed SNMP/SSH scans against routers, switches, and firewalls.
Question 4: An SC-200 analyst reviews a Defender for Endpoint alert titled 'Suspicious sequence of exploration activities.' This maps to which MITRE ATT&CK tactic?
- Initial Access
- Discovery (Correct answer)
- Lateral Movement
- Exfiltration
Correct answer: Discovery
Exploration activities such as running whoami, net user, ipconfig, and nltest map to the MITRE ATT&CK Discovery tactic (TA0007), where adversaries enumerate the environment after access.
Question 5: During a vulnerability assessment, a critical CVE is found affecting a Windows Server 2019 host. The vendor has not yet released a patch. Which Defender Vulnerability Management feature can mitigate exploitation risk without patching?
- Apply a security baseline profile
- Use the built-in remediation task to block the port
- Enable the 'Block vulnerable application' capability to block the vulnerable version (Correct answer)
- Submit a false positive report to Microsoft
Correct answer: Enable the 'Block vulnerable application' capability to block the vulnerable version
Defender Vulnerability Management's 'Block vulnerable application' feature allows analysts to block execution of a specific vulnerable software version on devices as an interim mitigation until a patch is available.
Question 6: A red team uses BloodHound to map Active Directory attack paths and identifies a path to Domain Admin via an unconstrained Kerberos delegation account. Which Microsoft Defender for Identity alert would fire when the red team exploits this path?
- Suspected DCSync attack (replication of directory services)
- Suspected Kerberos delegation abuse using forged authorization data (Bronze Bit)
- Suspected overpass-the-hash attack
- Suspected identity theft (pass-the-ticket) using Kerberos tickets (Correct answer)
Correct answer: Suspected identity theft (pass-the-ticket) using Kerberos tickets
Exploiting unconstrained delegation typically involves stealing a TGT from the delegating host's memory and using it elsewhere, which MDI detects as a pass-the-ticket (identity theft) alert.
Question 7: An analyst sees a Microsoft Defender for Cloud alert 'Digital currency mining activity' on an Azure Linux VM. What is the attacker's most likely initial access method that Defender for Cloud should also be investigating?
- Brute force attack on RDP
- Exploitation of a vulnerable web application or exposed service (Correct answer)
- Phishing email with a malicious macro
- Supply chain compromise of a deployed container image
Correct answer: Exploitation of a vulnerable web application or exposed service
Cryptominers on cloud VMs are most commonly deployed after exploiting a vulnerable public-facing web app or exposed service (e.g., Redis, Elasticsearch, Jenkins) rather than via phishing.
SC-200 Vulnerability Assessment & Penetration Testing 3
An analyst uses Defender for Cloud's regulatory compliance dashboard and sees a control failing under the NIST SP 800-53 benchmark.
The failing check is 'Vulnerabilities in security configuration on your machines should be remediated.' Which underlying technology provides the raw assessment data for this check?