SC-200 Mock Exam 75 — 25 Questions

Question 1

You are a SOC analyst using Microsoft Sentinel. You need to create a hunting query that searches for unusual outbound RDP connections from workstations. Which KQL operators or functions would be most essential for this query?

Accepted Answer

DeviceNetworkEvents and where LocalPort == 3389 and RemoteIPType == 'Public'. Hunting for outbound RDP requires identifying connections on port 3389 from workstations. Option B is correct because DeviceNetworkEvents includes network connections and port information. Option A is incorrect because DeviceLogonEvents is for logon sessions. Option C is incorrect because DeviceProcessEvents is for processes. Option D is incorrect because DeviceEvents may not include network details.

Answer

DeviceProcessEvents and where ProcessCommandLine contains 'mstsc'

Answer

DeviceLogonEvents and where LogonType == 'RemoteInteractive'

Answer

DeviceEvents and where ActionType contains 'RDP'

Question 2

Which TWO of the following are valid methods to perform threat hunting in Microsoft Sentinel? (Choose TWO.)

Accepted Answer

Create and save custom KQL queries in the Hunting blade. Options A and D are correct. A: The Hunting blade provides a list of built-in hunting queries. D: Custom KQL queries can be created and saved. Option B is wrong because Playbooks are for automated response, not hunting. Option C is wrong because Workbooks are for visualization, not interactive hunting.

Answer

Configure automated response rules to detect threats

Answer

Use Workbooks to visualize data and identify anomalies

Answer

Create a Playbook to automatically run queries on a schedule

Question 3

You are threat hunting in Microsoft Sentinel and have enabled UEBA. You want to detect a possible privilege escalation where a user creates a new user account and adds it to a privileged role within minutes. Which UEBA anomaly type should you investigate?

Accepted Answer

Mass role assignment changes. UEBA detects 'Mass role assignment changes' as an anomaly that could indicate privilege escalation. Option A (Impossible travel) is for geographic anomalies. Option B (Unusual file access) is for data exfiltration. Option D (Anomalous sign-in) focuses on authentication.

Answer

Unusual file access

Answer

Impossible travel

Answer

Anomalous sign-in

Question 4

Which THREE actions are recommended when conducting a threat hunt for compromised identities using Microsoft Sentinel UEBA?

Accepted Answer

Search for access to applications the user does not normally use. UEBA is used to detect anomalous behavior; focusing on unusual logon times, multiple failed attempts, and unusual application access are key indicators of compromised identities. Option C (investigating firewall changes) is more for network security. Option E (reviewing DNS logs) is for network anomalies.

Answer

Query DNS logs for unusual domain resolutions

Answer

Investigate changes to firewall rules

Question 5

Which TWO of the following are valid techniques for threat hunting using Microsoft Sentinel? (Select TWO.)

Accepted Answer

Using Jupyter notebooks with MSTICpy for advanced analytics.. Options A and B are correct. A: Jupyter notebooks allow custom analysis. B: LIVB provides interactive investigation. C: Automation rules are for response, not hunting. D: Watchlists can be used but are not a hunting technique per se. E: Playbooks are for automated response.

Answer

Creating watchlists to correlate data from external sources.

Answer

Deploying playbooks to automatically remediate threats.

Answer

Configuring automation rules to trigger on incident creation.

Question 6

Your organization uses Microsoft Defender XDR for threat hunting. You suspect a threat actor is using scheduled tasks for persistence. Which hunting query would you use in Microsoft 365 Defender advanced hunting to find newly created scheduled tasks?

Accepted Answer

DeviceEvents | where ActionType == 'ScheduledTaskCreated'. Advanced hunting uses tables like DeviceEvents. Option B is correct because the ScheduledTaskCreated action in DeviceEvents captures scheduled task creation. Option A is incorrect because DeviceProcessEvents records process events, not scheduled tasks. Option C is incorrect because DeviceRegistryEvents is for registry changes. Option D is incorrect because DeviceFileEvents tracks file creation, not scheduled tasks directly.

Answer

DeviceRegistryEvents | where RegistryKey contains 'Tasks'

Answer

DeviceProcessEvents | where FileName == 'schtasks.exe'

Answer

DeviceFileEvents | where FolderPath contains 'Tasks'

Question 7

You are threat hunting for signs of Microsoft 365 mailbox compromise. Which hunting query in Microsoft 365 Defender would be most effective for identifying suspicious mailbox forwarding rules?

Accepted Answer

EmailEvents | where EmailAction == 'Forward'. Mailbox forwarding rules are captured in the EmailEvents table. Option A is correct because it filters for forwarding actions. Option B is incorrect because EmailPostDeliveryEvents is for post-delivery actions. Option C is incorrect because DeviceEvents is for devices. Option D is incorrect because AlertInfo is for alerts, not raw events.

Answer

DeviceEvents | where ActionType contains 'Mailbox'

Answer

AlertInfo | where Title contains 'forward'

Answer

EmailPostDeliveryEvents | where Action == 'Forward'

Question 8

You are hunting for signs of ransomware activity. Which of the following behaviors in Microsoft Defender for Endpoint should you prioritize as a high-confidence indicator?

Accepted Answer

A process encrypting or renaming large numbers of files in rapid succession. Option A is correct because mass file encryption or renaming is a direct sign of ransomware. Option B is wrong because while shadow copy deletion is common after ransomware, it can also be done by legitimate tools. Option C is wrong because large file downloads can be benign. Option D is wrong because scheduled task creation is common for persistence but not specific to ransomware.

Answer

A process deleting Volume Shadow Copies

Answer

A process creating a scheduled task

Answer

A process downloading multiple files from the internet

Question 9

During a threat hunt in Microsoft Defender XDR, an analyst discovers that a specific user account has been executing unusual PowerShell commands from a non-corporate device. The analyst wants to investigate the timeline of these activities across all Microsoft 365 services. Which advanced hunting schema should be used to correlate these events?

Accepted Answer

IdentityLogonEvents. The IdentityLogonEvents table in advanced hunting captures authentication events, including device and user details, which is essential for correlating activities across services. Option B (DeviceEvents) is for endpoint processes, not logon correlation. Option C (EmailEvents) is for email tracking. Option D (CloudAppEvents) covers cloud app activities but not logon context.

Answer

DeviceEvents

Answer

CloudAppEvents

Answer

EmailEvents

Question 10

A threat hunter runs the KQL query above in Microsoft Sentinel. What is the main limitation of this query?

Accepted Answer

The query relies on an external data source that may be slow or unavailable. Using externaldata() to fetch a list from a public URL may introduce latency or fail if the URL is unreachable, and the list may not be updated in real-time. Option A is incorrect because IdentityLogonEvents does contain IPAddress. Option B is incorrect because the query correctly references the let statement. Option D is incorrect because externaldata supports CSV format.

Answer

The IdentityLogonEvents table does not have an IPAddress column

Answer

The let statement is incorrectly defined because it uses externaldata without a schema

Answer

The with(format="csv") is invalid

Question 11

You are hunting for signs of ransomware in your environment using Microsoft 365 Defender. Which advanced hunting table should you primarily query to detect file encryption events?

Accepted Answer

DeviceFileEvents. Option B is correct because DeviceFileEvents captures file creation, modification, and deletion events, which are typical for ransomware encryption. Option A is wrong because it's for network connections. Option C is wrong because it's for process creation. Option D is wrong because it's for registry modifications.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

DeviceRegistryEvents

Question 12

During a threat hunt, you notice an unusual number of DNS queries for randomly generated subdomains from a single workstation. You suspect data exfiltration via DNS tunneling. Which KQL query in Microsoft Sentinel would best help you identify the suspicious domain names?

Accepted Answer

let entropy_threshold = 4.0; let length_threshold = 20; CommonSecurityLog | where DeviceVendor == "Palo Alto" | extend entropy = strlen(DestinationHostName) - countof(DestinationHostName, 'a', 'z') / strlen(DestinationHostName) | where entropy > entropy_threshold or strlen(DestinationHostName) > length_threshold. Option B is correct because it calculates entropy and length to detect algorithmically generated domains, a common indicator of DNS tunneling. Option A is wrong because it only lists top domains by count, not randomness. Option C is wrong because it filters non-.com domains, missing many DGA domains. Option D is wrong because it queries a static threat intelligence list, not dynamic analysis.

Answer

CommonSecurityLog | where DestinationHostName !endswith ".com"

Answer

CommonSecurityLog | where DestinationHostName in (dynamic_threat_intel_list)

Answer

CommonSecurityLog | where DeviceVendor == "Palo Alto" | summarize count() by DestinationHostName | top 10 by count_

Question 13

Refer to the exhibit. You are using a hunting query in Microsoft Defender XDR to find devices generating excessive DNS queries. The query returns many results, but you want to exclude legitimate DNS servers. What is the best approach to refine the query?

Accepted Answer

Add a `where` clause to exclude known internal DNS server IPs.. Option C is correct because filtering out known DNS server IPs reduces false positives. Option A is wrong because changing the port to 53 is already done. Option B is wrong because increasing the threshold may miss real attacks. Option D is wrong because joining with identity info is unnecessary and may not help.

Answer

Join with DeviceInfo to filter by device type.

Answer

Change the RemotePort filter to UDP 53 only instead of all DNS.

Answer

Increase the count threshold to 5000.

Question 14

A threat hunter wants to correlate alerts from multiple Microsoft security products in Microsoft Sentinel. Which feature should be used to create a unified incident?

Accepted Answer

Analytics Rules. Option D is correct because Incident creation rules (or analytics rules) can create incidents from alerts across products. Option A is wrong because it is for notebooks. Option B is wrong because it is for external threat intelligence. Option C is wrong because it is for investigation.

Answer

Threat Intelligence

Answer

Jupyter Notebooks

Answer

Investigation Graph

Question 15

During a threat hunting exercise, you need to pivot from a suspicious IP address to find all related alerts and incidents in Microsoft Sentinel. Which feature should you use?

Accepted Answer

Investigation graph. The investigation graph in Microsoft Sentinel allows visual pivoting and exploration of entities. Option A is correct because it provides a graphical view of connections between entities. Option B is incorrect because the incidents blade shows incidents but not entity relationships. Option C is incorrect because playbooks automate responses. Option D is incorrect because workbooks are for dashboards.

Answer

Workbook

Answer

Incidents blade

Answer

Playbook

Question 16

During a threat hunt in Microsoft Sentinel, you find a series of suspicious sign-ins to Microsoft Entra ID from an IP address known to be associated with a threat actor. Which entity should you pivot on to investigate further?

Accepted Answer

IP address. The IP address is the key entity linking the sign-ins. Option C is correct. Option A is incorrect because the user is a target, not the pivot. Option B is incorrect because the device may be compromised but is not the initial pivot. Option D is incorrect because the application is secondary.

Answer

User account

Answer

Application

Answer

Device

Question 17

During a threat hunt in Microsoft Sentinel, you find a query that returns a high number of false positives. Which action should you take to refine the hunt?

Accepted Answer

Add additional filters to the query to exclude known benign activity. Option C is correct because tuning the query by adding more conditions reduces false positives. Option A is wrong because increasing the time range would likely increase false positives. Option B is wrong because removing columns does not affect false positives. Option D is wrong because creating an alert rule is for ongoing detection, not for refining the hunt.

Answer

Increase the query time range to gather more data

Answer

Create a scheduled alert rule based on the query

Answer

Remove columns from the result set to simplify analysis

Question 18

A threat hunter in Microsoft Sentinel wants to detect attempts to disable security logging on Windows servers using a KQL query. Which Windows Event ID should the query filter on to capture security log clearing events?

Accepted Answer

1102. Event ID 1102 in Windows Security log indicates the security log was cleared, which is a common technique used by attackers to cover tracks. Option A (4688) is for process creation. Option B (4624) is for successful logon. Option D (5145) is for network share access.

Answer

4688

Answer

4624

Answer

5145

Question 19

Which TWO actions are effective when threat hunting for lateral movement using remote desktop protocol (RDP) in Microsoft Defender XDR?

Accepted Answer

Query DeviceNetworkEvents for inbound connections on port 3389. Querying DeviceNetworkEvents for inbound RDP connections (port 3389) helps identify potential lateral movement. Correlating with LogonEvents for successful RDP logins confirms the movement. Option B (looking for SMB connections) is more for file sharing. Option D (checking email forwarding) is for exfiltration. Option E (reviewing cloud app activities) is not directly RDP-related.

Answer

Review CloudAppEvents for access to cloud apps from multiple IPs

Answer

Check for unusual email forwarding rules

Answer

Search for SMB file share connections

Question 20

As a threat hunter, you want to proactively search for signs of privilege escalation using the 'AzureHound' tool within your Microsoft Sentinel environment. Which data source is most relevant to ingest to detect AzureHound usage?

Accepted Answer

Azure Active Directory Audit Logs (now Microsoft Entra ID Audit Logs). Option D is correct because AzureHound uses the Microsoft Graph API to collect Azure AD data, and that activity is logged in AuditLogs. Option A is wrong because AzureHound does not run on VMs. Option B is wrong because it's not about networking. Option C is wrong because AzureHound does not create storage blobs.

Answer

Azure VM Insights logs

Answer

Azure Storage analytics logs

Answer

Azure Network Watcher logs