Cryptography & Encryption Flashcards

A Defender for Cloud alert fires for a VM running a process with high CPU consuming on TCP port 3333. What type of attack does this pattern most suggest?

Answer: Cryptomining (cryptojacking)

Port 3333 is a common Monero mining pool port, and high CPU usage from an unknown process strongly indicates cryptojacking.

When configuring Always Encrypted in Azure SQL Database, where must the Column Encryption Key (CEK) be stored to maintain security?

Answer: In Azure Key Vault or a local certificate store, never in the database

Always Encrypted stores only the encrypted CEK value in the database; the plaintext CEK is protected by a Column Master Key kept in a trusted key store like Azure Key Vault.

An analyst uses Microsoft Sentinel to hunt for golden ticket attacks. Which cryptographic element does a golden ticket attack forge?

Answer: The Kerberos TGT signed with the KRBTGT account's NTLM hash

Golden ticket attacks forge Kerberos Ticket Granting Tickets (TGTs) using the compromised KRBTGT account hash, granting unlimited domain access.

Which KQL function in Microsoft Sentinel can be used to extract and decode Base64 strings found in command-line arguments?

Answer: base64_decode_tostring()

The base64_decode_tostring() KQL function decodes Base64-encoded data directly within Sentinel queries to reveal obfuscated commands.

Microsoft Defender for Office 365 detects an email where the attacker used S/MIME to sign a phishing message with a legitimate-looking certificate. What does S/MIME signing verify?

Answer: That the sender's identity is bound to a certificate authority-issued certificate

S/MIME digital signatures use a certificate to authenticate the sender's identity, but do not prevent phishing if the certificate is obtained fraudulently.

A security operations team wants to ensure that Azure Storage encryption keys are rotated automatically. Which Azure feature enables automatic key rotation for Customer-Managed Keys (CMK)?

Answer: Azure Key Vault key rotation policy with auto-rotate

Azure Key Vault supports configurable key rotation policies that automatically rotate keys on a defined schedule without service interruption.

During incident response, an analyst finds that malware used CryptProtectData (DPAPI) to encrypt stolen credentials before exfiltration. What is significant about DPAPI from a forensics perspective?

Answer: DPAPI keys are tied to the user/machine context, so decryption requires the victim's credentials or domain backup key

DPAPI encryption is tied to the Windows user or machine context; recovering the domain backup key (if available) or user credentials is required for forensic decryption.