Vulnerability Assessment & Penetration Testing Flashcards

A security analyst uses Microsoft Defender Vulnerability Management to prioritize patches. Which metric does the platform's Threat-Based Vulnerability Management feature use to elevate a CVE's priority above its CVSS score alone?

Answer: Active exploit kit or threat actor activity linked to the CVE

Threat-Based Vulnerability Management elevates CVE priority when active exploit kits or tracked threat actors are observed exploiting that vulnerability in the wild.

During a purple-team exercise, the red team uses Mimikatz to extract NTLM hashes from LSASS memory. Which Microsoft Defender for Endpoint setting, when enabled, prevents this technique without killing the LSASS process?

Answer: Attack Surface Reduction rule: Block credential stealing from LSASS

The ASR rule 'Block credential stealing from the Windows local security authority subsystem' (LSASS) blocks attempts to dump credentials from LSASS memory via tools like Mimikatz.

An analyst reviews a Microsoft Secure Score recommendation to 'Reduce the attack surface with ASR rules.' Which portal is the primary location to configure and report on Attack Surface Reduction rules in an SC-200 context?

Answer: Microsoft Defender portal (security.microsoft.com)

ASR rule configuration, reporting, and per-device mode overrides are managed in the Microsoft Defender portal under Endpoints > Configuration management > Attack surface reduction.

A penetration tester discovers an exposed Azure storage account with anonymous blob read access. Which Microsoft Defender for Cloud recommendation would have flagged this misconfiguration before exploitation?

Answer: Storage account public access should be disallowed

Defender for Cloud's 'Storage account public access should be disallowed' recommendation flags storage accounts where anonymous blob access is enabled.

When running a vulnerability scan with Microsoft Defender Vulnerability Management, an analyst sees a device showing 'Not assessed' for a software component. What is the most likely reason?

Answer: The device has not been onboarded to Defender for Endpoint

Devices not onboarded to Microsoft Defender for Endpoint cannot have their software inventory collected, so they appear as 'Not assessed' in Vulnerability Management.

A red team operator uses PowerShell to download and execute a second-stage payload from a remote URL using IEX (Invoke-Expression). Which Microsoft Defender for Endpoint capability is specifically designed to detect and block this AMSI-bypassing technique?

Answer: Script scanning via AMSI integration

AMSI (Antimalware Scan Interface) integration allows Defender to scan in-memory PowerShell content at runtime, catching obfuscated or dynamically constructed scripts before execution.

During a penetration test debrief, the client asks about 'exposure score' in Microsoft Defender Vulnerability Management. What does a high exposure score indicate?

Answer: The organization's devices are at high risk due to unpatched vulnerabilities and misconfigurations

A high exposure score in Defender Vulnerability Management indicates that the organization's devices collectively have significant unpatched vulnerabilities and security misconfigurations that increase breach risk.