Cryptography & Encryption Flashcards

An SC-200 analyst reviews a Defender for Endpoint alert about a process calling BCryptEncrypt with a hardcoded key. What security concern does hardcoding encryption keys represent?

Answer: It prevents key rotation and exposes the key to static analysis or binary extraction

Hardcoded keys cannot be rotated and can be extracted through reverse engineering, making the encryption trivially breakable.

Which Microsoft Purview feature uses encryption to restrict who can access sensitive documents even after they are downloaded outside the organization?

Answer: Microsoft Purview Information Protection sensitivity labels with encryption

Sensitivity labels in Microsoft Purview can apply AES encryption and usage rights that persist with the document regardless of where it is stored.

A threat actor uses RC4 encryption in a malware C2 communication protocol. Why is RC4 considered cryptographically weak?

Answer: RC4 has known statistical biases in its keystream making ciphertext vulnerable to analysis

RC4's keystream has statistical biases (especially in early bytes) that allow attackers to recover plaintext or keys through cryptanalysis.

When Microsoft Sentinel detects unusual Azure Key Vault operations, which audit log event should analysts focus on to identify unauthorized secret access?

Answer: AzureDiagnostics | where ResourceType == 'VAULTS' and ResultType == 'Success' and OperationName == 'SecretGet'

SecretGet operations in AzureDiagnostics for Key Vault vaults reveal when secrets were successfully retrieved, helping identify unauthorized access.

An analyst investigates a Silver Ticket attack against a SQL Server service. Which cryptographic secret is compromised in a Silver Ticket attack, compared to a Golden Ticket?

Answer: The target service account's NTLM hash or AES key, not the KRBTGT hash

Silver Tickets forge service tickets using the service account's hash — they don't require the KRBTGT key but are scoped to one service.

Microsoft Defender for Cloud recommends enabling Transparent Data Encryption (TDE) on an Azure SQL Database. What does TDE encrypt at rest?

Answer: The entire database, transaction log, and backup files using AES-256

TDE performs real-time I/O encryption of the database, transaction log, and backups at rest using AES-256, transparently to the application.

An attacker performs a Kerberoasting attack to obtain service ticket hashes. Which encryption type is easiest to crack offline and indicates a misconfiguration?

Answer: RC4-HMAC (NTLM-based Kerberos encryption)

RC4-HMAC encrypted service tickets are faster to crack offline than AES tickets; service accounts should be configured to require AES-only Kerberos encryption.