SC-200 Practice Question 3811
Exam: SC-200
Domain: Respond to security incidents
Difficulty: medium
You are investigating an alert where an attacker ran Mimikatz to dump credentials on a domain member server. Which Attack Surface Reduction (ASR) rule is specifically designed to block this activity in memory?
Answer Options
A
Block credential stealing from the Windows LSASS subsystem
B
Block Adobe Reader from creating child processes
C
Block untrusted and unsigned processes that run from USB
D
Block JavaScript or VBScript from launching downloaded executable content
Correct Answer
A: Block credential stealing from the Windows LSASS subsystem
Explanation
"Block credential stealing from the Windows local security authority subsystem (lsass.exe)" prevents processes from opening LSASS memory handles to steal NTLM/Kerberos secrets.