SC-200 Mock Exam 72 — 25 Questions

Question 1

A threat hunter wants to proactively search for signs of ransomware activity in the environment using Microsoft Sentinel. Which data source is most likely to provide early indicators of ransomware, such as mass file renaming or encryption?

Accepted Answer

Microsoft Defender for Endpoint advanced hunting tables like DeviceFileEvents and DeviceProcessEvents. Option B (Microsoft Defender for Endpoint) provides advanced hunting on endpoint processes and file events, which can detect mass file modifications indicative of ransomware. Option A (Azure Activity Log) logs control plane operations. Option C (Office 365 audit logs) logs cloud app activities. Option D (Azure AD sign-in logs) logs authentication events.

Answer

Azure AD sign-in logs

Answer

Azure Activity Log

Answer

Office 365 audit logs (UnifiedAuditLog)

Question 2

A threat hunter is using Microsoft Sentinel to hunt for a potential advanced persistent threat (APT) that is using living-off-the-land binaries (LOLBins). The hunter creates a KQL query that lists all instances of certutil.exe making network connections. The query returns many legitimate results. What is the best way to reduce false positives while still detecting malicious use?

Accepted Answer

Add additional filters to the query to detect only certutil.exe processes with suspicious command-line arguments (e.g., '-urlcache' or '-split'). Option A (add conditions for unusual command-line arguments) is correct because malicious use of LOLBins often involves specific arguments (e.g., -urlcache, -split). Option B (ignore certutil.exe) would miss threats. Option C (switch to Sysmon) adds overhead but does not reduce false positives on its own. Option D (expand to all LOLBins) increases noise.

Answer

Replace the query with a Sysmon Event ID 3 (network connect) filter for certutil.exe

Answer

Remove certutil.exe from the hunting query and focus on other binaries

Answer

Expand the query to include all LOLBins that make network connections

Question 3

A threat hunter is using Microsoft Sentinel to hunt for signs of privilege escalation via Azure AD role assignment changes. Which TWO KQL operators or functions are most useful for identifying changes that added a user to a high-privilege role?

Accepted Answer

summarize. Option A (where) filters for specific operations like 'Add member to role'. Option C (summarize) can count changes per user or role. Option B (project) only selects columns. Option D (mvexpand) expands multi-valued fields. Option E (evaluate) is for plugin operators.

Answer

project

Answer

evaluate

Answer

mvexpand

Question 4

Your threat hunt involves correlating alerts from Microsoft Defender for Cloud Apps with Microsoft Defender for Endpoint. Which Microsoft Sentinel integration should you use to unify these alerts for hunting?

Accepted Answer

Microsoft Sentinel's unified analytics rules and incident creation. Option A is correct because Microsoft Sentinel provides built-in connectors and analytics rules to correlate alerts across Microsoft Defender XDR, including Defender for Cloud Apps and Defender for Endpoint. Option B (Microsoft Graph API) is programmatic but not a unified hunting experience. Option C (Azure Monitor Workbooks) visualizes but does not correlate. Option D (Power Automate) automates responses but not correlation.

Answer

Power Automate flows to merge alerts

Answer

Microsoft Graph API to pull alerts into a custom database

Answer

Azure Monitor Workbooks to display alerts side by side

Question 5

During a hunt, you find that a user account has logged in from an IP address associated with a known command-and-control (C2) server. The hunt also reveals that the same IP accessed a SharePoint site containing sensitive documents. Which Microsoft Purview feature should you use to investigate data exfiltration?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Option B is correct because Microsoft Purview Data Loss Prevention (DLP) policies and activity explorer can show if sensitive data was accessed or shared externally. Option A (Information Protection) labels data but does not track exfiltration. Option C (Audit Log) logs events but lacks context of sensitive data. Option D (Compliance Manager) is for assessments, not investigation.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Audit (Standard)

Question 6

During a threat hunt, you discover a suspicious PowerShell command that decoded a base64 string and executed a script. Which Microsoft Defender for Endpoint advanced hunting table should you query to find the decoded command line?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents stores process creation events including command lines. DeviceEvents stores raw events but not command lines. DeviceNetworkEvents is for network connections. IdentityLogonEvents is for logons. The correct table for command lines is DeviceProcessEvents.

Answer

IdentityLogonEvents

Answer

DeviceNetworkEvents

Answer

DeviceEvents

Question 7

A threat hunter wants to use Microsoft Sentinel's UEBA to identify anomalous behavior. Which data connector must be enabled to provide the necessary Azure Active Directory (now Microsoft Entra ID) sign-in logs for UEBA?

Accepted Answer

Microsoft Entra ID. UEBA requires sign-in logs. The Microsoft Entra ID connector provides sign-in logs. Option B is for audit logs only. Option C is for Windows security events. Option D is for Office 365. The correct answer is the Microsoft Entra ID connector.

Answer

Office 365

Answer

Microsoft Entra ID Audit

Answer

Windows Security Events via AMA

Question 8

Which TWO Microsoft Sentinel hunting features can be used to automatically surface suspicious activities without manual query writing?

Accepted Answer

Livestream. Hunting queries are pre-built queries that run on a schedule. Livestream allows real-time detection of specific events. Option C (Analytics rules) is for detection, not hunting. Option D (Workbooks) is visualization. Option E (Playbooks) is automation. The correct options are A and B.

Answer

Workbooks

Answer

Analytics rules

Answer

Playbooks

Question 9

You are reviewing a hunting query that identifies accounts with failed logons followed by successful logons from the same IP. The query returns no results even though you suspect brute force activity. What is the most likely issue?

Accepted Answer

The join condition is too strict; the SourceIP might differ between failed and successful logons. The join uses 'inner', which requires matching keys in both sides. If the IP is different for failed and successful logons (e.g., attacker changes IP), the join fails. Option A (time range) is unlikely. Option C (EventID) is correct. Option D (threshold) is not the issue. The correct answer is B.

Answer

The time range is too short

Answer

The threshold is too low

Answer

The EventID for successful logon is incorrect

Question 10

During a threat hunt, you discover a PowerShell script that downloads and executes a payload from a known malicious URL. The script was run on multiple workstations. Which Microsoft Defender XDR action should you take to contain the threat?

Accepted Answer

Initiate a device isolation on the affected workstations using Microsoft Defender for Endpoint.. Option D is correct because Microsoft Defender for Endpoint can isolate devices to prevent further spread. Option A only removes the file but does not prevent re-infection. Option B blocks the URL but not the already infected machines. Option C is a detection, not containment.

Answer

Run a full antivirus scan on all affected workstations.

Answer

Add the URL to the custom indicator list in Microsoft Defender XDR.

Answer

Create a custom detection rule in Microsoft Sentinel.

Question 11

A threat hunter is investigating a potential data exfiltration via DNS tunneling using Microsoft Defender for Endpoint advanced hunting. Which THREE columns from the DeviceNetworkEvents table should the hunter include in a query to detect anomalous DNS queries?

Accepted Answer

RemoteUrl. Option A (RemoteIP) is the destination IP of the DNS server; not the queried domain. Option B (RemoteUrl) contains the domain name being queried. Option C (InitiatingProcessFileName) shows which process made the query. Option D (Timestamp) is essential for time patterns. Option E (ActionType) indicates if it's a DNS query. Correct: RemoteUrl, InitiatingProcessFileName, Timestamp. ActionType is not a column in DeviceNetworkEvents for DNS; it's in DeviceEvents.

Answer

ActionType

Answer

RemoteIP

Question 12

You need to create a custom detection rule in Microsoft Sentinel that alerts when an anomalous number of failed logons occur from a single IP address within 5 minutes. Which KQL operator should you use to count failed logons per IP?

Accepted Answer

summarize. Option A is correct because 'summarize' is used to aggregate counts per key (IP). Option B (project) only selects columns. Option C (extend) adds calculated columns. Option D (where) filters rows.

Answer

project

Answer

where

Answer

extend

Question 13

During a hunt, you find a device that made successive outbound connections to multiple IP addresses on port 445 (SMB) within a short time. Which type of activity does this pattern most likely indicate?

Accepted Answer

Lateral movement preparation. Port 445 is used for SMB. Rapid successive connections to many IPs on SMB suggests scanning for open SMB shares, often a precursor to lateral movement. Option A (data exfiltration) typically uses HTTP/HTTPS. Option C (C2 beaconing) uses common ports like 80/443. Option D (reconnaissance) is broad; the specific pattern points to lateral movement via SMB.

Answer

Data exfiltration

Answer

Command and control beaconing

Answer

Internal reconnaissance

Question 14

You are creating a custom hunting query in Microsoft Sentinel for PowerShell Empire indicators. After deploying, the query never returns results, even though you know empire activity exists in the environment. What is the most likely cause?

Accepted Answer

The query logic is flawed; it should group the conditions with parentheses. The query uses 'or' incorrectly; the condition 'ProcessCommandLine contains 'System.Net.WebClient'' is evaluated separately from the FileName condition, so it would match any process with WebClient, not just PowerShell. Option A: 'contains' is correct for substring. Option B: 'and' would make it too restrictive. Option C: The connector is fine. The correct answer is D: the logical operator precedence is wrong.

Answer

The query should use 'and' instead of 'or'

Answer

The required data connector should be 'MicrosoftThreatProtection'

Answer

The 'contains' operator should be 'startswith'

Question 15

You are creating a custom detection rule in Microsoft Sentinel using the JSON above. The rule does not trigger any alerts despite known PowerShell encoded commands executing. What is the most likely cause?

Accepted Answer

The filename 'powershell.exe' is case-sensitive and may not match actual events.. Option B is correct because the query is case-sensitive and 'powershell.exe' may be invoked as 'PowerShell.exe' with different casing. Option A is plausible but less likely because the file name is often lowercase. Option C is incorrect because the JSON has correct syntax. Option D is incorrect because the query is valid KQL.

Answer

The query uses 'contains' which is not supported in custom detections.

Answer

The query is missing a time filter.

Answer

The JSON has a syntax error.

Question 16

Refer to the exhibit. The KQL query is used for threat hunting in Microsoft 365 Defender. What is the primary purpose of this query?

Accepted Answer

Identify periods of high scheduled task creation activity that may indicate lateral movement.. The query filters for scheduled task events, groups by ActionType and hourly buckets, then returns only those hours with more than 10 events. Option A is correct because it identifies high-frequency scheduled task activity, which could indicate lateral movement or persistence. Option B is incorrect because it does not compare to a baseline. Option C is incorrect because it does not list specific tasks. Option D is incorrect because it does not correlate with known threats.

Answer

List all scheduled tasks created in the last 7 days.

Answer

Correlate scheduled task creation with known threat actor techniques.

Answer

Calculate the baseline of scheduled task creation per hour.

Question 17

Refer to the exhibit. The KQL query is used for threat hunting in Microsoft Defender XDR. What is the most likely scenario this query is designed to detect?

Accepted Answer

Ransomware dropping executables on desktops and spreading via SMB. The query looks for .scr files (screensaver, but also used to disguise executables) with names matching 8 lowercase letters on the desktop, and correlates with SMB connections to private IPs. Option A is correct because ransomware often drops executables on desktops and spreads via SMB. Option B is incorrect because the file is on the desktop, not in startup. Option C is incorrect because no registry events are involved. Option D is incorrect because the file is .scr, not .lnk.

Answer

Persistence mechanism via startup folder

Answer

Registry modification to disable security tools

Answer

Phishing campaign delivering .lnk files

Question 18

A threat hunter runs the KQL query above in Microsoft Sentinel to detect accounts that have experienced multiple failed sign-in attempts due to a disabled account (ResultType 50057) from the same IP. The query returns no results even though the hunter knows that some disabled accounts are being attacked. What is the most likely reason for the false negatives?

Accepted Answer

The time range (1h) is too narrow; the attacks may be spread over several hours. Option B is correct because the query only looks at the last 1 hour; if attacks occurred over a longer period, they would be missed. Option A (ResultType wrong) is possible but not the most likely since 50057 is correct. Option C (summarize over UserPrincipalName alone) would group by user, but the query already includes IPAddress. Option D (threshold too high) could be, but the scenario says attacks are happening; time window is the most likely cause.

Answer

The ResultType value 50057 is incorrect; it should be 50058 for disabled account

Answer

The query should group by UserPrincipalName only, not by IPAddress

Answer

The threshold of 5 is too high; reducing it would show results

Question 19

You are investigating a potential DCSync attack. Which Advanced Hunting query in Microsoft Defender XDR would best detect a process making atypical directory replication requests?

Accepted Answer

DeviceEvents | where ActionType == 'DirectoryReplicationRequest'. Option C is correct because DeviceEvents captures 'DirectoryReplicationRequest' events from Microsoft Defender for Identity. Option A (IdentityLogonEvents) captures logons. Option B (IdentityDirectoryEvents) captures directory changes but not replication requests. Option D (DeviceProcessEvents) captures process creation.

Answer

IdentityDirectoryEvents | where ActionType == 'Replication'

Answer

DeviceProcessEvents | where FileName contains 'ntdsutil'

Answer

IdentityLogonEvents | where ActionType == 'DirectoryReplication'

Question 20

To hunt for malicious PowerShell encoded commands, which columns in the DeviceProcessEvents table in Microsoft 365 Defender advanced hunting should you focus on?

Accepted Answer

ProcessCommandLine. The ProcessCommandLine column contains the full command line, including encoded commands. Option A (FileName) only shows the executable name. Option B (InitiatingProcessFileName) shows parent process. Option D (DeviceName) is the machine name. The correct column is ProcessCommandLine.

Answer

DeviceName

Answer

FileName

Answer

InitiatingProcessFileName