|
| 1 | +### YamlMime:ModuleUnit |
| 2 | +uid: learn.wwl.discover-external-assets-vulnerabilities.knowledge-check |
| 3 | +metadata: |
| 4 | + title: Knowledge check |
| 5 | + description: Check your knowledge of discovering unprotected assets and vulnerabilities using Microsoft Defender External Attack Surface Management. |
| 6 | + ms.date: 04/07/2026 |
| 7 | + author: r-c-stewart |
| 8 | + ms.author: roberts |
| 9 | + ms.topic: unit |
| 10 | + ai-usage: ai-generated |
| 11 | +title: Knowledge check |
| 12 | +durationInMinutes: 3 |
| 13 | +content: | |
| 14 | + [!include[](includes/6-knowledge-check.md)] |
| 15 | +quiz: |
| 16 | + title: Check your knowledge |
| 17 | + questions: |
| 18 | + - content: "A security engineer wants visibility into internet-facing assets their organization doesn't know about—including forgotten test environments from an acquisition and developer-created shadow IT. Which Microsoft Defender tool provides this outside-in discovery capability?" |
| 19 | + choices: |
| 20 | + - content: "Microsoft Defender for Cloud Security Posture Management (CSPM)" |
| 21 | + isCorrect: false |
| 22 | + explanation: "Incorrect. Defender CSPM provides inside-out posture management for known, enrolled Azure resources. It assesses misconfigurations and compliance gaps within your Azure subscription, but it doesn't discover assets that exist outside your subscription or outside your inventory." |
| 23 | + - content: "Microsoft Defender Vulnerability Management (MDVM)" |
| 24 | + isCorrect: false |
| 25 | + explanation: "Incorrect. MDVM provides inside-out vulnerability scanning for known, enrolled virtual machines. It identifies CVEs in installed software on VMs that are already part of your inventory—it doesn't discover unknown or unenrolled internet-facing assets." |
| 26 | + - content: "Microsoft Defender External Attack Surface Management (EASM)" |
| 27 | + isCorrect: true |
| 28 | + explanation: "Correct. Defender EASM uses outside-in recursive discovery to map your organization's internet-facing attack surface from an attacker's perspective. It discovers unknown and unmonitored assets—including assets from acquired organizations, forgotten environments, and shadow IT—by traversing infrastructure connections starting from known seeds." |
| 29 | + - content: "Microsoft Defender for Endpoint" |
| 30 | + isCorrect: false |
| 31 | + explanation: "Incorrect. Defender for Endpoint provides endpoint detection and response (EDR) capabilities for enrolled devices. It doesn't perform external attack surface discovery or identify internet-facing assets outside your managed device inventory." |
| 32 | + - content: "You're configuring EASM discovery for your organization after an acquisition. You provide the acquired company's primary domain name as a starting point. What is this starting asset called in the EASM discovery process?" |
| 33 | + choices: |
| 34 | + - content: "A discovery target" |
| 35 | + isCorrect: false |
| 36 | + explanation: "Incorrect. 'Discovery target' isn't a term used in EASM's discovery process. EASM uses seeds as the known starting points for recursive discovery." |
| 37 | + - content: "A discovery seed" |
| 38 | + isCorrect: true |
| 39 | + explanation: "Correct. Discovery seeds are known legitimate assets you provide as starting points for EASM's recursive discovery engine. The engine queries multiple data sources (WHOIS, DNS, SSL certificates, ASN records) for each seed and recurses through connections to uncover previously unknown assets." |
| 40 | + - content: "A candidate asset" |
| 41 | + isCorrect: false |
| 42 | + explanation: "Incorrect. Candidate is an asset state in the EASM inventory—it means EASM discovered an asset that it believes is owned by your organization but is unconfirmed. The starting point you provide to initiate discovery is called a seed." |
| 43 | + - content: "An inventory filter" |
| 44 | + isCorrect: false |
| 45 | + explanation: "Incorrect. Inventory filters are used within EASM to search and sort discovered assets in your inventory. They aren't used to initiate or configure the discovery process." |
| 46 | + - content: "After running EASM discovery for a recently acquired company's infrastructure, your security team finds several hosts with Telnet (port 23) open and multiple SSL certificates expiring within 30 days. Which EASM dashboard surfaces these specific technical findings?" |
| 47 | + choices: |
| 48 | + - content: "Overview dashboard" |
| 49 | + isCorrect: false |
| 50 | + explanation: "Incorrect. The Overview dashboard is the default landing page that provides an at-a-glance summary of your attack surface including high-level risk counts by severity. It doesn't surface specific technical findings like individual open ports or SSL certificate details." |
| 51 | + - content: "Attack surface summary dashboard" |
| 52 | + isCorrect: false |
| 53 | + explanation: "Incorrect. The Attack surface summary dashboard shows SSL certificate expiry counts by timeframe (30, 60, 90 days) and broad vulnerability severity counts. However, the Security posture dashboard surfaces the specific technical details: individual open ports and exposed services like Telnet, SSL certificate configuration problems such as expired or SHA-1 certificates, CVE exposure, and domain administration issues." |
| 54 | + - content: "Security posture dashboard" |
| 55 | + isCorrect: true |
| 56 | + explanation: "Correct. The Security posture dashboard is the primary dashboard for security engineers investigating specific external hygiene issues. It surfaces detailed technical findings including CVE exposure, open ports, and exposed services (such as Telnet on port 23), SSL certificate configuration issues (expired certificates, weak cipher suites, SHA-1 certificates), and domain administration concerns." |
| 57 | + - content: "OWASP Top 10 dashboard" |
| 58 | + isCorrect: false |
| 59 | + explanation: "Incorrect. The OWASP Top 10 dashboard surfaces web application vulnerabilities in categories such as broken access control, cryptographic failures, injection, and security misconfiguration. It doesn't surface infrastructure-level findings like open ports or SSL certificate expiry status." |
| 60 | + - content: "Your organization has Defender CSPM active. You want to find attack paths that start from internet-exposed IP addresses discovered by EASM and trace through to internal Azure resources. Where do you view these attack paths?" |
| 61 | + choices: |
| 62 | + - content: "In the EASM standalone portal at the Security posture dashboard" |
| 63 | + isCorrect: false |
| 64 | + explanation: "Incorrect. The EASM Security posture dashboard shows external security hygiene findings—CVE exposure, open ports, SSL issues—within the EASM portal itself. It doesn't show attack paths that trace from internet-exposed IPs through to internal Azure resources." |
| 65 | + - content: "In the Microsoft Defender portal under Cloud security, go to Attack path analysis" |
| 66 | + isCorrect: true |
| 67 | + explanation: "Correct. With Defender CSPM active, EASM integration flows outside-in data into the Defender portal. Under Cloud security > Attack path analysis, you can filter attack paths by internet-exposed resources to see exploitable paths that start from EASM-discovered internet-facing IPs and trace through to internal target assets." |
| 68 | + - content: "In Microsoft Sentinel under the Threat Intelligence workbook" |
| 69 | + isCorrect: false |
| 70 | + explanation: "Incorrect. Microsoft Sentinel is a SIEM and SOAR solution focused on security event correlation and threat detection. Attack path analysis that combines EASM outside-in data with Defender CSPM inside-out data is available in the Microsoft Defender portal, not Microsoft Sentinel." |
| 71 | + - content: "In the Azure portal under Microsoft Defender for Cloud, go to Workload protections" |
| 72 | + isCorrect: false |
| 73 | + explanation: "Incorrect. Workload protections in the Azure portal provide threat protection status and alerts for specific workload types such as servers, containers, and storage. Attack path analysis integrating EASM data is available in the Microsoft Defender portal under Cloud security > Attack path analysis." |
0 commit comments