SC-200 Vulnerability Assessment & Penetration Testing 3

Question 1

An analyst uses Defender for Cloud's regulatory compliance dashboard and sees a control failing under the NIST SP 800-53 benchmark. The failing check is 'Vulnerabilities in security configuration on your machines should be remediated.' Which underlying technology provides the raw assessment data for this check?

Accepted Answer

Azure Policy guest configuration

Answer

Azure Policy guest configuration (formerly Azure Automation DSC) assesses OS-level security configuration baselines and feeds that data into Defender for Cloud's compliance controls.

Question 2

A penetration tester successfully pivots from a compromised Azure VM to an Azure SQL database using a managed identity token. Which Defender for Cloud feature would have detected this lateral movement attempt in real time?

Accepted Answer

Microsoft Defender for SQL — threat detection alert for anomalous access

Answer

Microsoft Defender for SQL generates real-time threat detection alerts for anomalous access patterns, including access from unusual compute resources like a VM that normally doesn't query the database.

Question 3

A security engineer wants to run authenticated vulnerability scans against network devices that cannot have the MDE sensor installed. Which Defender Vulnerability Management feature supports agentless scanning for these devices?

Accepted Answer

Network device scanning with a designated scanner device

Answer

Defender Vulnerability Management's network device scanning feature uses a designated MDE-onboarded device to perform credentialed SNMP/SSH scans against routers, switches, and firewalls.

Question 4

An SC-200 analyst reviews a Defender for Endpoint alert titled 'Suspicious sequence of exploration activities.' This maps to which MITRE ATT&CK tactic?

Accepted Answer

Discovery

Answer

Exploration activities such as running whoami, net user, ipconfig, and nltest map to the MITRE ATT&CK Discovery tactic (TA0007), where adversaries enumerate the environment after access.

Question 5

During a vulnerability assessment, a critical CVE is found affecting a Windows Server 2019 host. The vendor has not yet released a patch. Which Defender Vulnerability Management feature can mitigate exploitation risk without patching?

Accepted Answer

Enable the 'Block vulnerable application' capability to block the vulnerable version

Answer

Defender Vulnerability Management's 'Block vulnerable application' feature allows analysts to block execution of a specific vulnerable software version on devices as an interim mitigation until a patch is available.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Vulnerability Assessment & Penetration Testing 3