SC-200 Practice Test 3 — 10 Questions

Question 1

A threat hunter runs the KQL query above in Microsoft Sentinel. What is the main limitation of this query?

Accepted Answer

The query relies on an external data source that may be slow or unavailable. The query uses the externaldata() operator to fetch a list of IP addresses from an external URL. This introduces a dependency on that external source, which may be slow, fail, or be out of date. Option A correctly identifies this limitation. Option B is incorrect because the IdentityLogonEvents table does have an IPAddress column. Option C is incorrect because the let statement is correctly defined with a schema. Option D is incorrect because the with(format='csv') is valid for CSV files.

Answer

The IdentityLogonEvents table does not have an IPAddress column

Answer

The let statement is incorrectly defined because it uses externaldata without a schema

Answer

The with(format="csv") is invalid

Question 2

You are using Microsoft Sentinel to manage incidents. You want to automatically close incidents that are older than 90 days and have a status of 'New'. What is the most efficient way to achieve this?

Accepted Answer

Create a playbook that runs on a schedule (e.g., daily) and closes incidents that meet the criteria.. A scheduled playbook is the most efficient way to automatically close stale incidents because Microsoft Sentinel playbooks (Logic Apps) support recurrence triggers that can query the Sentinel incidents API on a schedule, filter by status 'New' and createdTime older than 90 days, and close them in bulk. This is a native, low-code automation path that doesn't require manual intervention or modifying detection logic.

Answer

Create a workbook that shows old incidents and manually close them.

Answer

Modify the analytics rule to automatically close incidents after 90 days.

Answer

Create an automation rule that triggers on incident update and closes the incident if the created time is older than 90 days.

Question 3

Which THREE of the following are recommended practices for creating effective threat hunting queries in Microsoft Sentinel? (Select three.)

Accepted Answer

Include known indicators of compromise from threat feeds. Option C is correct because incorporating known indicators of compromise (IOCs) such as malicious IP addresses, domains, file hashes, and URLs from threat intelligence feeds lets hunting queries directly surface activity tied to known adversaries, which is a core recommended practice in Microsoft Sentinel. Option D is correct because mapping queries to MITRE ATT&CK techniques aligns hunting with specific adversary tactics and techniques, enabling coverage tracking, prioritization of gaps, and consistent query design across the kill chain. Option E is correct because constraining a query to a specific, relevant time range improves performance and reduces noise, ensuring the hunt focuses on the window of interest rather than scanning the entire retention period. Option A is not recommended because overly broad patterns generate excessive false positives and dilute the signal, and Option B is not recommended because excessive wildcard use degrades KQL query performance and precision, making results harder to triage.

Answer

Use only broad patterns to avoid missing anything

Answer

Use wildcards extensively to capture variations

Question 4

Which TWO conditions must be met to enable Microsoft Sentinel UEBA? (Choose two.)

Accepted Answer

Microsoft Entra ID P2 licenses must be assigned to users.. Microsoft Sentinel UEBA requires the SecurityInsights solution to be installed in the Log Analytics workspace, as this solution provides the UEBA data connectors and analytics rules. Additionally, Microsoft Entra ID P2 licenses are required because UEBA relies on the identity protection and risk detection capabilities that are only available with P2 licensing, enabling the enrichment of entity behavior profiles with risk data.

Answer

KQL queries must be created for entity behavior.

Answer

Microsoft Defender XDR must be onboarded.

Answer

Azure SQL Database must be deployed.

Question 5

You are reviewing a hunting query. What is the primary purpose of this query?

Accepted Answer

Find users with medium-risk sign-ins that share IP addresses with service principal sign-ins, indicating possible token theft or lateral movement. The query filters for users with medium risk sign-ins and joins with service principal sign-ins on IP address, then counts occurrences per user exceeding 5, indicating potential compromise involving both user and service principal activity from the same IP. Option A is wrong because it does not focus on service principal compromise alone. Option B is wrong because it does not look for admin consent grants. Option D is wrong because it uses only medium risk, not high.

Answer

List all users with any risk level during sign-in in the last 7 days

Answer

Detect users who have granted admin consent to malicious OAuth apps

Answer

Identify service principals that have been compromised and are performing high-risk sign-ins

Question 6

Which THREE data sources can be used in Microsoft Sentinel for threat hunting to detect unusual authentication patterns? (Choose three.)

Accepted Answer

SecurityEvent (Windows Event Logs). Option A, SecurityEvent (Windows Event Logs), is correct because it ingests Windows security events such as 4624, 4625, and 4648, which reveal logon successes, failures, and explicit credential use that are essential for spotting unusual authentication patterns on hosts. Option B, AADNonInteractiveUserSignInLogs, is correct because it captures non-interactive Microsoft Entra ID sign-ins (token, service principal, and client-credential flows) that often indicate anomalous or automated authentication activity missed by interactive-only logs. Option E, SigninLogs (Microsoft Entra ID), is correct because it records interactive Entra ID sign-in events with details like IP address, location, device, conditional access result, and risk level, directly supporting detection of unusual authentication behavior. Option C, CommonSecurityLog, is not among the marked answers because it primarily carries CEF-formatted data from third-party security appliances (firewalls, proxies, IDS/IPS) rather than identity authentication telemetry. Option D, OfficeActivity (Office 365), is not among the marked answers because it focuses on Office 365 workload operations such as file, mailbox, and admin activities, not core authentication sign-in patterns.

Answer

CommonSecurityLog

Answer

OfficeActivity (Office 365)

Question 7

Your organization uses Microsoft Defender XDR. The incident queue shows multiple alerts related to a single endpoint: malware detected, suspicious PowerShell execution, and data exfiltration attempts. The analyst needs to investigate the incident. Which tool should the analyst use to correlate these events?

Accepted Answer

Advanced hunting in Microsoft Defender XDR.. Advanced hunting in Microsoft Defender XDR allows the analyst to query across multiple data sources—including endpoint detection and response (EDR), identity, email, and cloud app data—using Kusto Query Language (KQL). This enables correlation of the malware detection, suspicious PowerShell execution, and data exfiltration alerts on the same device by joining tables such as DeviceEvents, DeviceProcessEvents, and DeviceNetworkEvents, providing a unified timeline of the attack chain.

Answer

Microsoft Defender for Office 365 Explorer.

Answer

Microsoft Defender for Cloud Apps activity log.

Answer

Microsoft Sentinel incident workspace.

Question 8

A security analyst is investigating a phishing campaign using Microsoft 365 Defender advanced hunting. The analyst needs to find all emails sent from a specific sender address in the last 7 days. Which table should be queried?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft 365 Defender advanced hunting stores metadata about email messages, including sender addresses, recipients, timestamps, and delivery actions. To find all emails from a specific sender in the last 7 days, you query EmailEvents because it contains the 'SenderFromAddress' or 'SenderMailFromAddress' fields needed to filter by sender. The other tables focus on attachments, URLs, or device-level events, which are not relevant for identifying emails by sender address.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

DeviceEvents

Question 9

Which THREE techniques are commonly used in Microsoft Sentinel threat hunting to identify command and control (C2) communication? (Select THREE.)

Accepted Answer

Detecting DNS tunneling. Detecting DNS tunneling (B) is correct because attackers frequently encode C2 data inside DNS queries and responses, and Sentinel hunting queries can flag anomalies such as high-entropy subdomains, excessive TXT/NULL record requests, or unusually long query names in DNS events. Analyzing network beaconing patterns (C) is correct because C2 implants typically check in at regular intervals, so hunting for periodic, low-volume outbound connections (for example, consistent time deltas or repeated small byte counts to the same destination) helps reveal compromised hosts. Examining SSL/TLS certificate anomalies (D) is correct because malicious C2 infrastructure often uses self-signed, expired, mismatched, or otherwise suspicious certificates, and Sentinel can correlate certificate metadata from network logs to identify such traffic. Analyzing email headers for phishing (A) is not a C2 communication technique; it targets initial access via email, and identifying brute force attempts (E) addresses credential attacks rather than command-and-control traffic.

Answer

Analyzing email headers for phishing

Answer

Identifying brute force attempts

Question 10

A threat hunter is analyzing a potential advanced persistent threat (APT) that uses living-off-the-land binaries (LOLBins) like certutil.exe to download payloads. The hunter wants to find instances where certutil.exe was used to download files from the internet in the last week. Which KQL query in Microsoft Sentinel would be most effective?

Accepted Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "certutil.exe"
| where ProcessCommandLine contains "-urlcache" or ProcessCommandLine contains "-split"
| project Timestamp, DeviceName, ProcessCommandLine. The query in option C correctly targets certutil.exe and filters for the specific command-line arguments '-urlcache' and '-split', which are commonly used by attackers to download files from the internet. This directly addresses the threat hunter's goal of finding certutil.exe download activity. The other options focus on different LOLBins (powershell.exe, mshta.exe, wscript.exe) that are not mentioned in the scenario.

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-enc"
| project Timestamp, DeviceName, ProcessCommandLine

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "mshta.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "wscript.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine