Cryptography & Encryption Flashcards

An SC-200 analyst investigates a ransomware incident where files have the extension .encrypted. The ransom note claims RSA-2048 was used. What does this imply about the decryption process?

Answer: The private RSA key held by the attacker is required to decrypt the symmetric key used for file encryption

Modern ransomware typically uses RSA to encrypt a per-victim symmetric key; recovery requires the attacker's private RSA key.

Which Microsoft Sentinel data connector ingests Azure Key Vault diagnostic logs to detect unauthorized key access attempts?

Answer: Azure Key Vault connector via Azure Monitor / Diagnostic Settings

Azure Key Vault diagnostic logs sent to a Log Analytics workspace via the Key Vault connector enable Sentinel to alert on suspicious key operations.

A threat hunter writes a KQL query to find processes that load known cryptomining libraries. Which table in Microsoft Defender for Endpoint (via advanced hunting) should they query?

Answer: DeviceImageLoadEvents

DeviceImageLoadEvents records DLL and library load events, making it ideal for detecting cryptomining or suspicious module loads.

What is the purpose of certificate pinning in the context of TLS security monitoring?

Answer: It binds a client to a specific server certificate or public key, preventing MITM via rogue CA certificates

Certificate pinning ensures the client only trusts a pre-defined certificate or key, blocking attacks that use fraudulent certificates from trusted CAs.

In Microsoft Entra ID, which authentication method uses asymmetric cryptography where the private key never leaves the device?

Answer: FIDO2 security keys

FIDO2 security keys use public-key cryptography where the private key is stored securely on the device and never transmitted.

A security analyst is investigating a data exfiltration alert. The attacker encrypted stolen data using a public key found in a GitHub repository. What attack pattern does this represent?

Answer: Asymmetric key-based exfiltration (bring-your-own-key)

Using a pre-distributed public key to encrypt exfiltrated data means only the attacker holding the private key can decrypt it — a common APT technique.

Which algorithm is used by Azure Information Protection (Microsoft Purview Information Protection) to encrypt document content?

Answer: AES-128 or AES-256

Azure Information Protection uses AES (128-bit or 256-bit) for document content encryption, with RSA used to protect the AES key.