Vulnerability Assessment & Penetration Testing Flashcards

A security analyst configures a Defender for Endpoint custom indicator to block a file hash associated with a penetration testing tool used legitimately by the internal red team. What is the recommended approach to allow the red team's use while keeping the block for all other users?

Answer: Create a device group for red team devices and set the indicator to 'Allowed' scoped to that group

Custom indicators support 'Allowed' actions scoped to specific device groups, enabling you to permit a tool on red team devices while blocking it everywhere else.

During a penetration test, the tester uses Azure CLI with a stolen storage account key to enumerate blobs. Which Microsoft Defender for Storage alert would be triggered by this activity if Defender for Storage is enabled?

Answer: Access from an unusual location to a storage account

When a valid key is used to access a storage account from an IP or region that has never accessed it before, Defender for Storage raises an 'Access from an unusual location' alert.

A vulnerability scan of an AKS cluster reveals that a pod is running as root. Which Microsoft Defender for Containers check would flag this as a misconfiguration?

Answer: CIS Kubernetes Benchmark: Containers should not run as root user

Defender for Containers maps to CIS Kubernetes Benchmark controls, and running containers as root violates the control 'Containers should not run as root user (UID 0).'

An analyst wants to correlate vulnerability findings from Defender Vulnerability Management with threat intelligence in Microsoft Sentinel. Which data connector enables this integration?

Answer: Microsoft Defender XDR data connector (streaming MDE vulnerability events to Sentinel)

The Microsoft Defender XDR data connector streams Defender for Endpoint events, including DeviceTvmSoftwareVulnerabilities, into Microsoft Sentinel for correlation with other data sources.

A penetration tester establishes persistence via a scheduled task that runs a PowerShell script with a -EncodedCommand argument. Which Defender for Endpoint advanced hunting table would best surface this technique?

Answer: DeviceProcessEvents

Scheduled tasks launching PowerShell with -EncodedCommand appear as child process creation events in the DeviceProcessEvents table, where ProcessCommandLine contains the encoded argument.

An SC-200 candidate must explain the difference between a vulnerability and an exposure in the context of Microsoft Defender Vulnerability Management. Which statement is correct?

Answer: A vulnerability is a weakness in software; an exposure is an overly permissive condition that increases attack surface

In Defender Vulnerability Management, vulnerabilities refer to software flaws (CVEs), while exposures refer to security misconfigurations or overly permissive settings that expand the attack surface.

A red team successfully exfiltrates data by encoding it in DNS query names to an external resolver. Which Microsoft Defender for Endpoint capability is best positioned to detect this DNS tunneling activity?

Answer: Defender for Endpoint's behavioral sensor detecting suspicious DNS query patterns

MDE's behavioral sensor analyzes process-level DNS query patterns and can detect anomalous high-entropy or high-frequency DNS queries indicative of DNS tunneling exfiltration.