SC-200 Mock Exam 76 — 25 Questions

Question 1

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You are hunting for a threat that uses 'process hollowing' to evade detection. Which advanced hunting query in Microsoft Defender for Endpoint would be most effective?

Accepted Answer

DeviceProcessEvents | where InitiatingProcessFileName != ImageFileName | where ParentProcessFileName != ImageFileName. Option A is correct because process hollowing often involves a child process with a different parent image; DeviceProcessEvents can show such anomalies. Option B is wrong because it looks for specific image names. Option C is wrong because file events are less direct. Option D is wrong because it waits for alerts.

Answer

DeviceProcessEvents | where FileName in~ ('rundll32.exe', 'regsvr32.exe', 'mshta.exe')

Answer

DeviceFileEvents | where FileName contains 'hollow'

Answer

AlertInfo | where Title contains 'Process hollowing'

Question 2

You are conducting a threat hunt for possible credential dumping using Mimikatz. Which Windows Security Event ID should you focus on in Microsoft Sentinel to detect potential use of Mimikatz?

Accepted Answer

Event ID 10 (Process accessed). Option A is correct because Event ID 10 (Lsass process access) is a common indicator of Mimikatz usage. Option B is wrong because Event ID 4688 is process creation, too broad. Option C is wrong because Event ID 4625 is failed logon, unrelated. Option D is wrong because Event ID 5156 is for Windows Filtering Platform connections, not credential dumping.

Answer

Event ID 4688 (Process creation)

Answer

Event ID 4625 (Failed logon)

Answer

Event ID 5156 (WFP connection)

Question 3

You are a security analyst at Fabrikam using Microsoft Sentinel. You are conducting a threat hunt for signs of remote code execution (RCE) via the Windows Event Log. You want to detect suspicious service creation that could indicate lateral movement. Specifically, you want to find events where a service was created (Event ID 7045) on a server, and within 5 minutes, a network connection was established from that server to another internal server. You have SecurityEvent and CommonSecurityLog tables ingested. Which KQL query should you use?

Accepted Answer

let ServiceCreation = SecurityEvent | where EventID == 7045 | project Computer, TimeGenerated; let NetworkConn = CommonSecurityLog | where DeviceAction == 'Allow' | project SourceIP, TimeGenerated; ServiceCreation | join kind=inner NetworkConn on $left.Computer == $right.SourceIP and abs(TimeGenerated - TimeGenerated) <= 5m. Option B is correct because it uses a join with a time window to correlate service creation and network connection. Option A is wrong because it lacks the join. Option C is wrong because it uses a time filter on creation, not correlation. Option D is wrong because it uses a union which is incorrect.

Answer

SecurityEvent | where EventID == 7045 | union CommonSecurityLog | where TimeGenerated > ago(1d)

Answer

SecurityEvent | where EventID == 7045 | project Computer, TimeGenerated | where TimeGenerated > ago(1h)

Answer

SecurityEvent | where EventID == 7045 | where TimeGenerated between (ago(1d) .. now()) | summarize by Computer

Question 4

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You are hunting for signs of a possible Kerberos Golden Ticket attack. Which advanced hunting table should you query to detect anomalous Kerberos ticket-granting ticket (TGT) requests?

Accepted Answer

IdentityDirectoryEvents. IdentityDirectoryEvents captures domain controller events, including Kerberos authentication details. Option A (IdentityLogonEvents) is for user logons. Option B (DeviceEvents) for endpoint processes. Option D (CloudAppEvents) for cloud apps.

Answer

IdentityLogonEvents

Answer

DeviceEvents

Answer

CloudAppEvents

Question 5

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. During a hunt, you notice that some alerts from Microsoft Defender for Identity are not appearing in Sentinel. You have verified the connector is enabled and data is flowing for other Defender products. What is the most likely cause?

Accepted Answer

Your tenant does not have the required Microsoft Entra ID P2 license for Microsoft Defender for Identity alerts.. Option D is correct because Microsoft Defender for Identity alerts require a premium Azure AD P2 license to be ingested via the connector. Option A is wrong because the connector is enabled. Option B is wrong because data ingestion is working for other products. Option C is wrong because the data types are not disabled.

Answer

The Microsoft Sentinel pricing tier is set to Free, which limits data ingestion.

Answer

The 'IdentityLogonEvents' data type is disabled in the Microsoft Sentinel connector configuration.

Answer

The Microsoft Sentinel workspace is in a different region than Microsoft Defender for Identity.

Question 6

Which TWO data sources are most useful for detecting unauthorized lateral movement in a hybrid environment using Microsoft Sentinel?

Accepted Answer

Microsoft Defender for Endpoint DeviceLogonEvents. Options A and C are correct because Windows Security Events (Event ID 4624) show logon details, and Microsoft Defender for Endpoint DeviceLogonEvents provide endpoint logon telemetry. Option B is wrong because Azure Activity Log records control plane operations, not logons. Option D is wrong because Network Security Group flow logs show network traffic but not authentication. Option E is wrong because Office 365 audit logs focus on cloud apps.

Answer

Azure Activity Log

Answer

Network Security Group Flow Logs

Answer

Office 365 Audit Logs

Question 7

Your organization uses Microsoft Sentinel to monitor a hybrid environment consisting of on-premises servers and cloud workloads in Azure. As a threat hunter, you have been tasked with identifying potential lateral movement using pass-the-hash (PtH) attacks. You have enabled UEBA and connected Windows Event Logs, including Event ID 4624 (logon) and 4648 (explicit credentials). You need to create a hunting query that surfaces anomalous remote logons where the same account logon from a non-domain joined machine using NTLM authentication. Which KQL query should you use to start your hunt?

Accepted Answer

SecurityEvent | where EventID == 4624 and LogonType == 3 and LogonProcessName contains 'NTLM' | where TargetUserName !endswith '$' | where Computer !in (list of domain controllers) | project TimeGenerated, Account=TargetUserName, SourceWorkstation=WorkstationName, LogonProcessName. Correct: Option B filters for logon type 3 (network), NTLM authentication (LogonProcessName contains NTLM), and non-domain joined workstations (WorkstationName not in list of domain controllers). Option A misses PtH indicators; Option C incorrectly uses RDP logon type 10; Option D focuses on interactive logons.

Answer

SecurityEvent | where EventID == 4624 and AccountType == 'User' and LogonType == 3 | where IpAddress != '' | summarize count() by Account, IpAddress

Answer

SecurityEvent | where EventID == 4624 and LogonType == 2 and LogonProcessName contains 'NTLM' | project TimeGenerated, Account=TargetUserName

Answer

SecurityEvent | where EventID == 4624 and LogonType == 10 and AuthenticationPackageName == 'NTLM' | project TimeGenerated, Account=TargetUserName, SourceIP=IpAddress

Question 8

The exhibit shows a hunting query definition in Microsoft Sentinel. What is the primary issue with this hunting query?

Accepted Answer

The ipv4_lookup function is used incorrectly because it requires a data source parameter. The query uses ipv4_lookup with a static lookup table 'solorigate_ips', but this function expects a parameter for the lookup data source. The correct syntax should reference a table or inline list. Option A is incorrect because the function exists. Option C is incorrect because the query scans the entire DeviceEvents table. Option D is incorrect because there is no syntax error with ActionType.

Answer

The ActionType filter is invalid

Answer

The query does not filter by timestamp

Answer

The ipv4_lookup function does not exist in KQL

Question 9

During a hunt, you discover that an attacker used a valid but compromised service principal to authenticate to Azure Key Vault and export secrets. Which Microsoft Sentinel hunting query would best identify similar activity across your environment?

Accepted Answer

ServicePrincipalSignInLogs | where ResultType == 0 | where ResourceDisplayName contains 'Key Vault'. Option C is correct because ServicePrincipalSignInLogs track service principal sign-ins, and auditing for successful access to Key Vault can reveal similar compromises. Option A is wrong because it's about user sign-ins. Option B is wrong because it's for user risk. Option D is wrong because it's for managed identity, not all service principals.

Answer

AADManagedIdentitySignInLogs | where ResultType == 0

Answer

SigninLogs | where ResultType == 0 | where AppDisplayName contains 'Key Vault'

Answer

AADUserRiskEvents | where RiskEventType == 'compromised'

Question 10

You are investigating a series of failed logon attempts across multiple on-premises servers. You want to use Microsoft Sentinel to hunt for patterns of brute-force attacks. Which data source should you ingest to capture detailed authentication events from domain controllers?

Accepted Answer

Windows Security Events via Windows Event Forwarding. Option C is correct because Windows Security Events from domain controllers include Event ID 4625 (failed logon) necessary for brute-force hunting. Option A is wrong because Azure Activity Log does not include on-premises authentication. Option B is wrong because Microsoft 365 Defender events focus on cloud identities. Option D is wrong because Syslog typically contains network device logs, not Windows authentication.

Answer

Syslog from domain controllers

Answer

Azure Activity Log

Answer

Microsoft 365 Defender events

Question 11

You are hunting for possible data exfiltration via email in Microsoft 365. Which data source in Microsoft Sentinel provides the most relevant telemetry for email forwarding rules?

Accepted Answer

Office 365 audit logs (Exchange). Option D is correct because Office 365 audit logs capture changes to mailbox rules, including forwarding. Option A is wrong because Azure AD sign-in logs show authentication, not mail flow. Option B is wrong because Windows Security Events are for on-premises. Option C is wrong because Microsoft Defender for Cloud Apps logs cover cloud app activity but not specifically mailbox rules.

Answer

Microsoft Defender for Cloud Apps logs

Answer

Windows Security Events

Answer

Azure AD sign-in logs

Question 12

Your organization uses Microsoft Defender for Identity (MDI) to monitor on-premises Active Directory. As a threat hunter, you receive an alert about a potential DCSync attack. You want to hunt for any other instances of this attack across your domain controllers over the past 30 days. Which hunting query should you run in Microsoft 365 Defender advanced hunting?

Accepted Answer

IdentityDirectoryEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'. Option C correctly uses the IdentityDirectoryEvents table to filter for DCSync attack type. Option A uses IdentityLogonEvents which is for logons, not directory replication; Option B uses IdentityQueryEvents but DCSync is a directory service attack, not a query; Option D uses the wrong table entirely.

Answer

DeviceEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Answer

IdentityLogonEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Answer

IdentityQueryEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Question 13

During a threat hunt in Microsoft Sentinel, you identify a series of successful logins from an unusual IP address to multiple Azure VM instances. The logins occur outside business hours. Which hunting technique would be most effective to correlate these events with potential lateral movement?

Accepted Answer

Use Microsoft Defender for Cloud Apps to perform session replay of the user's activities during that time.. Option B is correct because session replay allows you to reconstruct the sequence of events and identify lateral movement patterns. Option A is wrong because timeline correlation might miss the specific sequence. Option C is wrong because anomaly detection alone doesn't link the events. Option D is wrong because it's a detection, not hunting.

Answer

Run a KQL query that correlates sign-in logs with Azure activity logs using a common timestamp window.

Answer

Create a custom analytics rule in Microsoft Sentinel to alert on repeated logins from the same IP.

Answer

Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel to detect anomalies.

Question 14

Which THREE of the following are best practices for performing threat hunting in Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Start with a hypothesis based on threat intelligence or recent incidents.. Options A, B, and D are correct. A: Documenting hypotheses is key. B: Using multiple data sources enriches hunting. D: Hunting across endpoints, email, and identities provides full coverage. C: Relying solely on alerts is reactive. E: Using sample data may miss threats in other segments.

Answer

Focus only on alerts generated by automated detection rules.

Answer

Limit hunting to a single data source to reduce complexity.

Question 15

While hunting in Microsoft Sentinel, you find a KQL query that uses the `evaluate` operator with `bag_unpack` to expand JSON properties. The query runs slowly and times out. What is the best practice to optimize this query?

Accepted Answer

Add a `where` clause to filter rows before applying `bag_unpack`.. Option B is correct because filtering before expanding reduces the dataset size. Option A is wrong because materializing entire table is inefficient. Option C is wrong because increasing nodes may not help if the dataset is too large. Option D is wrong because reducing nodes starves resources.

Answer

Increase the cluster's concurrency and nodes.

Answer

Remove the `evaluate` operator and use `extend` with `parse_json`.

Answer

Use the `materialize` function to cache the entire table before expansion.

Question 16

Which TWO actions are essential for configuring Microsoft Sentinel to support effective threat hunting?

Accepted Answer

Connect Microsoft 365 data sources (e.g., Office 365, Entra ID, Defender for Cloud Apps). Enabling User and Entity Behavior Analytics (UEBA) provides baselines for hunting anomalies, and connecting Microsoft 365 data sources provides rich data for hunting. Customizing analytics rules is for detection, not hunting; Sysmon is not required; Watchlists are helpful but not essential for basic hunting setup.

Answer

Create a Watchlist that maps user names to email addresses

Answer

Configure custom analytics rules for every MITRE ATT&CK technique

Answer

Install Sysmon on all domain controllers

Question 17

A security analyst is hunting for signs of credential dumping using Microsoft Defender for Endpoint. Which advanced hunting query should the analyst use to detect the use of Mimikatz?

Accepted Answer

DeviceProcessEvents where ProcessCommandLine contains 'mimikatz'. Option C is correct because DeviceProcessEvents records process creation events, and Mimikatz often appears as a process. Option A is wrong because network events are not directly related to local credential dumping. Option B is wrong because registry events may show persistence but not the dumping itself. Option D is wrong because file creation events are less direct for process-based tools.

Answer

DeviceRegistryEvents where RegistryKey contains 'mimikatz'

Answer

DeviceFileEvents where FileName contains 'mimikatz'

Answer

DeviceNetworkEvents where RemoteIP contains 'mimikatz'

Question 18

Which TWO of the following are valid methods to detect Kerberoasting attacks during a threat hunt? (Select TWO.)

Accepted Answer

Service account logon events with RC4 encryption type.. Options B and D are correct. B: Unusual TGS requests from a single user can indicate Kerberoasting. D: Service account usage with RC4 encryption is a sign of Kerberoasting. A: NTLM authentication is not specific. C: Golden ticket attacks involve different artifacts.

Answer

Unusual number of LDAP queries from a domain controller.

Answer

High volume of NTLM authentication failures from a single IP.

Answer

Detection of forged Kerberos tickets (Golden Ticket) in the domain.

Question 19

You are hunting for signs of ransomware using Microsoft Defender XDR's advanced hunting. Which query pattern would best identify a process that encrypts many files in a short time?

Accepted Answer

DeviceFileEvents | where ActionType == 'FileModified' | summarize Count = count() by DeviceName, InitiatingProcessFileName, bin(Timestamp, 5m) | where Count > 100. Option A is correct because it counts file modifications per process and device, then filters for high counts. Option B is wrong because it focuses on process creations, not file modifications. Option C is wrong because it measures duration, not count. Option D is wrong because it only groups by device, missing the process responsible.

Answer

DeviceFileEvents | summarize Duration = max(Timestamp)-min(Timestamp) by DeviceName, InitiatingProcessFileName | where Duration < 1h

Answer

DeviceProcessEvents | where FileName in ('powershell.exe', 'wscript.exe') | summarize by DeviceName

Answer

DeviceFileEvents | summarize Count = count() by DeviceName | where Count > 1000

Question 20

A threat hunter wants to use Jupyter Notebooks in Microsoft Sentinel for hypothesis-driven hunting. Which THREE steps should the hunter take to set up and use this capability?

Accepted Answer

Enable Machine Learning-based analytics in Microsoft Sentinel under 'Entity behavior' settings. Enabling ML-based analytics in Microsoft Sentinel provides access to notebooks; provisioning an Azure Machine Learning workspace is required to run notebooks; connecting Microsoft Sentinel to an AML workspace is the final step to access data. Installing the MSTICpy library separately is not needed; notebooks use KQL, not PowerShell.

Answer

Install the MSTICpy Python library on each hunting analyst's workstation

Answer

Create a PowerShell runbook to automate notebook execution