Identity & Access Management Flashcards

An analyst investigates an alert about 'Suspected AS-REP Roasting' in Defender for Identity. What misconfiguration does this attack exploit?

Answer: Accounts configured with 'Do not require Kerberos preauthentication'

AS-REP Roasting targets accounts with Kerberos pre-authentication disabled, allowing attackers to request encrypted AS-REP responses and crack them offline.

Which Microsoft Entra ID report helps identify users who have not completed MFA registration and are at risk under a Conditional Access policy requiring MFA?

Answer: MFA registration details report (Authentication methods usage)

The Authentication methods usage and insights report shows MFA registration status per user, identifying gaps before enforcement causes lockouts.

A threat actor uses Pass-the-Hash to authenticate as a local administrator across multiple endpoints. Which Microsoft Defender for Identity detection covers this lateral movement technique?

Answer: Suspected Pass-the-Hash attack (NTLM)

Pass-the-Hash uses stolen NTLM hashes to authenticate without knowing the plaintext password, and Defender for Identity detects the abnormal NTLM authentication patterns.

Which log source in Microsoft Sentinel contains details about Azure resource authorization failures, including RBAC denials?

Answer: AzureActivity

The AzureActivity table logs Azure Resource Manager operations including authorization failures, role assignments, and resource-level RBAC decisions.

A Conditional Access policy uses 'Sign-in risk' as a condition. Which back-end service evaluates the sign-in risk score in real time?

Answer: Microsoft Entra ID Protection (Identity Protection)

Microsoft Entra ID Protection computes real-time sign-in risk scores using machine learning and feeds them to Conditional Access for policy enforcement.

Which Defender for Identity lateral movement path visualization feature helps analysts understand how an attacker could pivot from a compromised account to a Domain Admin?

Answer: Lateral movement paths (LMP) graph

Lateral Movement Paths in Defender for Identity visualize credential exposure chains showing which accounts and devices could be used to reach sensitive accounts.

An analyst wants to hunt for OAuth app consent grants that may indicate an illicit consent grant attack. Which Microsoft 365 Defender table should they query?

Answer: CloudAppEvents

CloudAppEvents in Microsoft 365 Defender logs cloud app activity including OAuth app consent grants, which can indicate illicit consent grant phishing attacks.