Exam SC-200 topic 2 question 5 discussion

correct

Why is it so important to copy the file ONLY as "asc_alerttest_662jfi039n". Please consider that I am a newbie in securities, and help guide me, thanks.

AD correct

The answer is correct, but the question itself is outdated. The doc link now shows a much simpler command curl -O https://secure.eicar.org/eicar.com.txt https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation#simulate-alerts-on-your-azure-vms-linux-

Note: There's no Azure Defender now. It is now Defender for Cloud. So this might be (should be) reflected in the exam if this is asked..

Option AD

Seems right as it is. Check this doc link below from step 3. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation#simulate-workload-alerts-k8snode_-prefix "Copy the executable to a separate location and rename it to ./asc_alerttest_662jfi039n with the following command cp /bin/echo ./asc_alerttest_662jfi039n. Execute the file ./asc_alerttest_662jfi039n testing eicar pipe."

To verify that an attack on the virtual machine triggers an alert in Azure Defender, you can use a test utility provided by Microsoft called "asc-alert-test." This utility is designed to safely simulate attacks and generate alerts for testing purposes. The correct commands are: C. cp /bin/echo ./alerttest D. ./asc_alerttest_662jfi039n testing eicar pipe Explanation: Command C: Copies the /bin/echo binary to create a test utility named alerttest which will be used to simulate the attack. Command D: Executes the asc_alerttest_662jfi039n utility with the appropriate parameters (testing eicar pipe) to simulate the attack and generate the alert. Commands A and B are incorrect because they refer to incorrect utility names or parameters. Remember, while using this utility, ensure you have necessary permissions and follow your organization's policies for testing and verifying security controls.

On exam - 19 June 2023

1. rename executable to ./asc_alerttest_662jfi039n 2. cp /bin/echo ./asc_alerttest_662jfi039n 3. Run in command prompt ./asc_alerttest_662jfi039n testing eicar pipe 4. Check Defender for Cloud alerts after about 10 mins to see an alert https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation#simulate-alerts-on-your-azure-vms-linux-

These answers are ridiculous, what is the difference if we choose B and C? They are the exact same commands with different naming for the file

correct

correct

Given answers are correct

correct

correct

AD is correct I'd say.