Mixed Deck — All SC-200 Topics Flashcards

A vulnerability scan of an AKS cluster reveals that a pod is running as root. Which Microsoft Defender for Containers check would flag this as a misconfiguration?

Answer: CIS Kubernetes Benchmark: Containers should not run as root user

Defender for Containers maps to CIS Kubernetes Benchmark controls, and running containers as root violates the control 'Containers should not run as root user (UID 0).'

A Logic Apps playbook fails intermittently when querying Microsoft Sentinel. Which best practice reduces transient failures?

Answer: Add retry policies to the HTTP or connector actions

Configuring retry policies on connector actions handles transient API errors and improves playbook reliability.

Which Microsoft Entra ID report helps identify users who have not completed MFA registration and are at risk under a Conditional Access policy requiring MFA?

Answer: MFA registration details report (Authentication methods usage)

The Authentication methods usage and insights report shows MFA registration status per user, identifying gaps before enforcement causes lockouts.

What is the first step in an incident response process?

Answer: Identify the incident

The first crucial step in any incident response process is identification, which involves detecting and confirming that a security incident has occurred. This includes monitoring systems for anomalies, analyzing alerts, and determining the scope and nature of the potential breach. Without proper identification, no further effective response actions can be taken.

Which Microsoft security solution provides endpoint threat detection and response?

Answer: Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is a comprehensive, cloud-powered endpoint security solution that provides advanced threat protection, post-breach detection, automated investigation, and response capabilities. It specifically focuses on securing endpoints like workstations and servers against sophisticated cyber threats. This makes it the correct Microsoft solution for endpoint threat detection and response.

A SOC analyst is reviewing Microsoft Defender for Endpoint alerts about suspicious use of certutil.exe. Which malicious cryptographic operation is certutil commonly abused for?

Answer: Decoding Base64-encoded payloads to drop malware

Threat actors abuse certutil.exe's -decode flag to convert Base64-encoded malware payloads into executable files on disk.

An organization subject to SOX compliance needs to demonstrate that privileged access to financial systems is properly controlled. Which Microsoft tool can provide evidence of privileged access reviews?

Answer: Microsoft Entra ID Privileged Identity Management (PIM) access reviews

Microsoft Entra ID PIM access reviews provide documented evidence that privileged access to sensitive systems is periodically reviewed and certified, satisfying SOX control requirements.

Which KQL operator would you use in Microsoft Sentinel to join the SecurityAlert table with the IdentityInfo table to enrich alerts with user department information?

Answer: join

The KQL 'join' operator merges rows from two tables based on a matching key, enabling enrichment of alerts with identity data.

When should risk assessments be updated in Microsoft Security Operations Analyst?

Answer: Regularly and whenever significant changes occur

Risk assessments should be living documents, updated regularly and whenever there are significant changes in conditions, processes, or scope.

What is the purpose of risk assessments in compliance programs?

Answer: Identify vulnerabilities and prioritize security measures

Risk assessments are crucial in compliance programs because they systematically identify potential vulnerabilities and threats within an organization's systems and processes. By evaluating the likelihood and impact of these risks, organizations can prioritize and implement appropriate security measures, ensuring resources are effectively allocated to protect sensitive assets and meet regulatory requirements.

What is the primary purpose of the NIST SP 800-61 framework in the context of security operations?

Answer: Providing guidelines for computer security incident handling

NIST SP 800-61 provides guidelines for establishing and operating an incident response program, covering preparation, detection, containment, eradication, and recovery phases.

Which Microsoft Sentinel analytics rule type uses machine learning to detect anomalies without requiring a manually written KQL query?

Answer: Anomaly (UEBA)

Anomaly rules in Microsoft Sentinel use built-in ML models from UEBA to detect unusual behavior without requiring custom KQL.

A security engineer wants to suppress repeated alerts from the same source IP for 1 hour after the first alert fires. Which Microsoft Sentinel feature handles this?

Answer: Alert suppression (also called 'Stop running query after alert is generated')

Alert suppression in analytic rules prevents re-triggering the same rule for a configurable period after an alert is generated.

A red team operator uses PowerShell to download and execute a second-stage payload from a remote URL using IEX (Invoke-Expression). Which Microsoft Defender for Endpoint capability is specifically designed to detect and block this AMSI-bypassing technique?

Answer: Script scanning via AMSI integration

AMSI (Antimalware Scan Interface) integration allows Defender to scan in-memory PowerShell content at runtime, catching obfuscated or dynamically constructed scripts before execution.

An analyst queries the DeviceProcessEvents table in Advanced Hunting and wants to find all instances where cmd.exe was spawned by a Microsoft Office application. Which KQL filter is MOST appropriate?

Answer: where FileName == 'cmd.exe' and InitiatingProcessFileName in ('winword.exe','excel.exe','powerpnt.exe')

Using 'in' with specific Office process names (winword.exe, excel.exe, powerpnt.exe) precisely targets Office-spawned cmd.exe instances.

An SC-200 analyst investigates a ransomware incident where files have the extension .encrypted. The ransom note claims RSA-2048 was used. What does this imply about the decryption process?

Answer: The private RSA key held by the attacker is required to decrypt the symmetric key used for file encryption

Modern ransomware typically uses RSA to encrypt a per-victim symmetric key; recovery requires the attacker's private RSA key.

A Conditional Access policy uses 'Sign-in risk' as a condition. Which back-end service evaluates the sign-in risk score in real time?

Answer: Microsoft Entra ID Protection (Identity Protection)

Microsoft Entra ID Protection computes real-time sign-in risk scores using machine learning and feeds them to Conditional Access for policy enforcement.

What is the primary benefit of security automation?

Answer: Reduces response time and minimizes errors

The primary benefit of security automation is its ability to streamline security operations by automating routine tasks, threat detection, and response actions. This leads to a significant reduction in the time required to address security events, minimizes the potential for human error in repetitive tasks, and allows security teams to focus on more complex strategic issues, thereby increasing overall efficiency and accuracy.

Which portal serves as the unified security console for managing Microsoft Defender for Endpoint?

Answer: Microsoft 365 Defender portal (security.microsoft.com)

The Microsoft 365 Defender portal at security.microsoft.com is the unified console for managing Defender for Endpoint alongside other Microsoft security products.

Which advanced hunting KQL query technique allows a Defender XDR analyst to parameterize a query and reuse it across multiple investigations?

Answer: Saved functions in the Sentinel function library

Microsoft Sentinel allows saving KQL as reusable functions in the workspace function library, which can be called by name in any query.