AZ-802 Secure Windows Server Infrastructure Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Direct Memory Access (DMA) Protection

  Why it's wrong here

  While DMA protection is important for securing a system against physical hardware attacks, it is not the primary requirement for Credential Guard's virtualization-based security. DMA protection helps prevent unauthorized devices from reading memory, but Credential Guard specifically relies on the CPU's ability to create isolated virtualized memory spaces for the LSA process.

• ✗

  Hyper-Threading Technology

  Why it's wrong here

  Hyper-Threading is a performance feature that allows a single physical CPU core to act as two logical processors. It does not provide any security boundaries or isolation capabilities required for Credential Guard. In fact, some security experts recommend disabling it in high-security environments to mitigate certain side-channel side-channel timing attacks.

• ✓

  Virtualization Extensions (Intel VT-x or AMD-V) and SLAT

  Why this is correct

  Credential Guard requires hardware virtualization extensions and Second Level Address Translation (SLAT) to run the LSA in a virtualized container. This isolation prevents even a compromised kernel from accessing the stored credentials. Without these CPU features, the system cannot create the secure 'Virtual Secure Mode' needed to protect the LSA secrets.

• ✗

  Hardware-enforced Stack Protection

  Why it's wrong here

  Hardware-enforced Stack Protection is a security feature that helps prevent memory corruption attacks like buffer overflows. While it enhances overall system security, it is not the foundational technology for Credential Guard. Credential Guard's primary mechanism is virtualization-based isolation, which is distinct from the stack protection features implemented in modern processors.