Vulnerability Assessment & Penetration Testing Flashcards

An organization uses Microsoft Defender Vulnerability Management and wants to track remediation work assigned to IT teams. Which built-in workflow feature enables an analyst to create and track these remediation tasks without leaving the Defender portal?

Answer: Use the 'Request remediation' feature to generate a remediation activity tracked in Defender Vulnerability Management

'Request remediation' in Defender Vulnerability Management lets analysts submit remediation activities directly to IT administrators with due dates, tracked within the portal's Remediation page.

During an assumed-breach penetration test of an Azure environment, the tester attempts to read the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254 from a compromised VM to obtain a managed identity token. Which Defender for Cloud alert indicates this technique was detected?

Answer: Azure Instance Metadata API accessed from a suspicious process

Defender for Cloud (Defender for Servers) generates an alert when a suspicious or unexpected process on a VM accesses the IMDS endpoint to obtain managed identity credentials.

A vulnerability assessment reveals that 300 devices have an outdated version of a third-party browser. In Microsoft Defender Vulnerability Management, where would an analyst go to see the unified remediation recommendation and affected device list for this finding?

Answer: Defender Vulnerability Management — Security recommendations page, filtered by software name

The Security recommendations page in Defender Vulnerability Management aggregates CVE and misconfiguration findings per software, showing affected device counts and recommended remediation actions.

A penetration tester uses a tool to spray passwords against Azure AD accounts without triggering per-account lockout. Which Microsoft Entra ID Protection risk detection is designed to catch this password spray behavior?

Answer: Password spray

Microsoft Entra ID Protection includes a 'Password spray' risk detection that identifies the low-and-slow pattern of trying a common password against many accounts to avoid lockout thresholds.

An analyst runs the following KQL query in Microsoft Sentinel: DeviceTvmSoftwareVulnerabilities | where CvssScore >= 9.0 | summarize count() by DeviceName. What is the analyst trying to determine?

Answer: Which devices have the highest number of critical-severity CVEs (CVSS ≥ 9.0)

The query counts CVEs with CVSS ≥ 9.0 per device, helping the analyst identify which devices carry the largest burden of critical vulnerabilities for prioritized remediation.

A red team operator uses the PrintNightmare exploit (CVE-2021-34527) against a Windows print server. Which Microsoft Defender for Endpoint alert category best describes this activity?

Answer: Privilege escalation

PrintNightmare exploits the Windows Print Spooler service to load a malicious DLL with SYSTEM privileges, making it a privilege escalation technique (MITRE T1068).

A security operations center wants to measure improvements in their organization's vulnerability remediation posture over a 90-day period using Microsoft Defender Vulnerability Management. Which metric should they track?

Answer: Exposure score trend over time in the Vulnerability Management dashboard

The exposure score trend in Defender Vulnerability Management directly tracks the organization's overall vulnerability risk over time, making it the best metric for measuring remediation progress.