Vulnerability Assessment & Penetration Testing Flashcards

An analyst uses Defender for Cloud's regulatory compliance dashboard and sees a control failing under the NIST SP 800-53 benchmark. The failing check is 'Vulnerabilities in security configuration on your machines should be remediated.' Which underlying technology provides the raw assessment data for this check?

Answer: Azure Policy guest configuration

Azure Policy guest configuration (formerly Azure Automation DSC) assesses OS-level security configuration baselines and feeds that data into Defender for Cloud's compliance controls.

A penetration tester successfully pivots from a compromised Azure VM to an Azure SQL database using a managed identity token. Which Defender for Cloud feature would have detected this lateral movement attempt in real time?

Answer: Microsoft Defender for SQL — threat detection alert for anomalous access

Microsoft Defender for SQL generates real-time threat detection alerts for anomalous access patterns, including access from unusual compute resources like a VM that normally doesn't query the database.

A security engineer wants to run authenticated vulnerability scans against network devices that cannot have the MDE sensor installed. Which Defender Vulnerability Management feature supports agentless scanning for these devices?

Answer: Network device scanning with a designated scanner device

Defender Vulnerability Management's network device scanning feature uses a designated MDE-onboarded device to perform credentialed SNMP/SSH scans against routers, switches, and firewalls.

An SC-200 analyst reviews a Defender for Endpoint alert titled 'Suspicious sequence of exploration activities.' This maps to which MITRE ATT&CK tactic?

Answer: Discovery

Exploration activities such as running whoami, net user, ipconfig, and nltest map to the MITRE ATT&CK Discovery tactic (TA0007), where adversaries enumerate the environment after access.

During a vulnerability assessment, a critical CVE is found affecting a Windows Server 2019 host. The vendor has not yet released a patch. Which Defender Vulnerability Management feature can mitigate exploitation risk without patching?

Answer: Enable the 'Block vulnerable application' capability to block the vulnerable version

Defender Vulnerability Management's 'Block vulnerable application' feature allows analysts to block execution of a specific vulnerable software version on devices as an interim mitigation until a patch is available.

A red team uses BloodHound to map Active Directory attack paths and identifies a path to Domain Admin via an unconstrained Kerberos delegation account. Which Microsoft Defender for Identity alert would fire when the red team exploits this path?

Answer: Suspected identity theft (pass-the-ticket) using Kerberos tickets

Exploiting unconstrained delegation typically involves stealing a TGT from the delegating host's memory and using it elsewhere, which MDI detects as a pass-the-ticket (identity theft) alert.

An analyst sees a Microsoft Defender for Cloud alert 'Digital currency mining activity' on an Azure Linux VM. What is the attacker's most likely initial access method that Defender for Cloud should also be investigating?

Answer: Exploitation of a vulnerable web application or exposed service

Cryptominers on cloud VMs are most commonly deployed after exploiting a vulnerable public-facing web app or exposed service (e.g., Redis, Elasticsearch, Jenkins) rather than via phishing.