SC-200 Mock Exam 76 — 25 Questions

Question 1

Which TWO data sources are most useful for detecting unauthorized lateral movement in a hybrid environment using Microsoft Sentinel?

Accepted Answer

Microsoft Defender for Endpoint DeviceLogonEvents. Option C, Microsoft Defender for Endpoint DeviceLogonEvents, is correct because it records interactive, network, and remote logon attempts (including type 3 and type 10) on endpoints, which are the primary telemetry for spotting credential-based lateral movement across hosts in a hybrid estate. Option D, Windows Security Events (Event ID 4624), is correct because successful logon events on domain-joined servers and workstations reveal authentication across the environment, and analyzing 4624 logon types (e.g., 3 network, 10 RDP) alongside source workstation and account fields exposes lateral movement paths. Option A, Azure Activity Log, is not the best fit because it captures control-plane operations on Azure resources (resource writes, role assignments) rather than host-to-host authentication activity. Option B, Network Security Group Flow Logs, only shows allowed/denied IP flows at the NSG level and lacks user or process context needed to confirm unauthorized lateral movement. Option E, Office 365 Audit Logs, covers cloud service activities such as mailbox and SharePoint access, not internal endpoint or domain logon traffic.

Answer

Azure Activity Log

Answer

Network Security Group Flow Logs

Answer

Office 365 Audit Logs

Question 2

Which TWO of the following are effective techniques for identifying lateral movement in Microsoft Defender for Endpoint advanced hunting? (Choose two.)

Accepted Answer

Search for remote desktop connections from non-administrative workstations. Option C is correct because in Microsoft Defender for Endpoint advanced hunting, RDP logons (e.g., LogonType 10 in DeviceLogonEvents) originating from non-administrative workstations are a classic lateral-movement indicator, since attackers pivot from a compromised user endpoint to other hosts rather than from trusted admin jump boxes. Option E is correct because NTLM authentication events (e.g., in DeviceLogonEvents or DeviceEvents with NTLM-related fields) can reveal pass-the-hash activity, where stolen NTLM hashes are reused to authenticate to remote systems without knowing the plaintext password, a hallmark of lateral movement. Option A is not the best fit because successful logons from public IP addresses typically indicate initial access or external exposure rather than internal lateral movement. Option B is unrelated because large uploads to cloud storage suggest exfiltration, not lateral movement. Option D is unrelated because phishing emails are an initial-access vector, not a lateral-movement detection technique in advanced hunting.

Answer

Check for successful logons from public IP addresses

Answer

Look for large file uploads to cloud storage

Answer

Monitor for phishing emails

Question 3

Which THREE actions are recommended when conducting a threat hunt for compromised identities using Microsoft Sentinel UEBA?

Accepted Answer

Search for access to applications the user does not normally use. Option A is correct because Microsoft Sentinel UEBA baselines each user's normal application usage, so access to applications the user does not normally use is a high-signal anomaly indicating possible credential compromise or token theft. Option C is correct because a burst of failed logon attempts followed by a successful one is the classic pattern of a brute-force or password-spray attack that ends in a valid session, and UEBA surfaces this as an anomalous sign-in sequence. Option E is correct because UEBA specifically models per-user behavioral baselines for logon times and locations, so deviations such as impossible travel or off-hours sign-ins are core indicators of a compromised identity. Option B does not belong because DNS log analysis targets command-and-control or malware beaconing rather than identity compromise, and it is not a UEBA identity-focused action. Option D does not belong because firewall rule changes are a network/infrastructure configuration concern, not an identity behavior anomaly tracked by UEBA.

Answer

Query DNS logs for unusual domain resolutions

Answer

Investigate changes to firewall rules

Question 4

Which THREE actions are part of the threat hunting process in Microsoft Defender XDR?

Accepted Answer

Investigate entities found in the results. Threat hunting in Microsoft Defender XDR follows a hypothesis-driven, iterative process, and option D ("Formulate a hypothesis based on threat intelligence") is correct because a hunt begins by defining a specific, testable hypothesis derived from threat intel, known TTPs, or an anomaly to guide the search. Option C ("Query advanced hunting using KQL") is correct because the hypothesis is tested by running KQL queries in Advanced Hunting against tables such as DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents to surface matching telemetry. Option B ("Investigate entities found in the results") is correct because any suspicious processes, devices, IPs, or accounts returned by the query are then pivoted on and investigated (e.g., via the entity page, timeline, and incident correlation) to confirm or refute the hypothesis. Option A ("Configure automated response actions") is not part of hunting itself; automated response is configured through automated investigation and response (AIR) and custom detection/action settings, which are remediation, not hunting. Option E ("Set data retention policies for hunting data") is not part of the hunting process; retention is governed by tenant/Advanced Hunting data retention settings and is an administrative configuration rather than a hunting step.

Answer

Configure automated response actions

Answer

Set data retention policies for hunting data

Question 5

Which THREE of the following are key considerations when designing a threat hunting program in Microsoft Defender XDR and Microsoft Sentinel? (Choose THREE.)

Accepted Answer

Understanding the data schema and available tables in the advanced hunting schema. Option A is correct because effective threat hunting in Microsoft Defender XDR and Microsoft Sentinel requires knowing the advanced hunting schema — the exact table names (e.g., DeviceProcessEvents, DeviceNetworkEvents, EmailEvents, SigninLogs) and column/field types — so hunters can write precise KQL queries that surface relevant telemetry rather than guessing at data locations. Option B is correct because operational security (OpSec) matters during manual hunting: hunters must avoid actions that tip off adversaries, such as querying or interacting with compromised hosts in ways that generate detectable artifacts, since adversaries may monitor for reconnaissance and change their tactics, techniques, and procedures (TTPs) or go dormant. Option E is correct because data retention policies directly bound what a hunting program can investigate — Microsoft Sentinel's analytics and hunting queries can only search data within the configured retention period (interactive retention plus long-term retention tiers), and Defender XDR's advanced hunting is limited to its own retention window (typically 30 days), so retention must be planned to support historical hunting and incident reconstruction. Option C is not correct here because, while MFA is a critical identity security control, it is a general security hardening measure rather than a specific design consideration for a threat hunting program. Option D is not correct because relying only on built-in detection rules contradicts the purpose of threat hunting, which is proactive, hypothesis-driven investigation beyond automated detections; hunters use custom KQL queries, not just out-of-the-box rules.

Answer

Implementing multi-factor authentication for all users

Answer

Using only built-in detection rules to identify threats

Question 6

You are responding to a ransomware incident where multiple devices are encrypted. The incident is captured in Microsoft Sentinel. Which TWO actions should you take first to contain the incident?

Accepted Answer

Disable user accounts associated with the affected devices in Microsoft Entra ID.. Option A is correct because disabling the associated user accounts in Microsoft Entra ID immediately blocks the compromised identities from authenticating and prevents the attacker from using those credentials to move laterally or re-access resources during containment. Option B is correct because isolating affected devices through Microsoft Defender for Endpoint severs network communication while preserving the device state for forensic investigation, which is the standard first containment step for ransomware. Option C is not a first containment action; password resets are remediation steps that come after disabling accounts and can be performed later without stopping active spread. Option D is incorrect because malware analysis is a post-containment investigative activity, not an immediate containment measure. Option E is incorrect because restoring from backups is a recovery action and should only occur after the threat is fully contained and eradicated, otherwise restored data can be re-encrypted.

Answer

Reset passwords for all affected users.

Answer

Run a malware analysis on a sample of the ransomware.

Answer

Restore encrypted files from backups.

Question 7

Which TWO built-in Microsoft Sentinel hunting queries are useful for detecting signs of compromised credentials?

Accepted Answer

Anomalous logon location. Option B, 'Anomalous logon location,' is correct because it flags authentication events where a user signs in from an unusual or unexpected geographic location, which is a classic indicator that credentials have been stolen and are being used by an attacker from a different region. Option C, 'Brute force attempt against user accounts,' is correct because it detects repeated failed authentication attempts followed by a success, directly surfacing password-guessing activity that results in compromised credentials. Option A, 'Baseline of user behavior,' is a general behavioral analytics query that establishes normal activity patterns rather than specifically detecting credential compromise. Option D, 'Deleted user account,' relates to account lifecycle or destructive actions, not credential theft. Option E, 'New user account creation,' indicates persistence or privilege escalation via a newly created account, not the compromise of existing credentials.

Answer

Baseline of user behavior

Answer

Deleted user account

Answer

New user account creation

Question 8

Which THREE data sources in Microsoft Sentinel are most useful for threat hunting activities related to identity compromise?

Accepted Answer

SecurityEvent. SecurityEvent (A) is correct because it captures Windows Security event log data such as 4624/4625 logons, 4672 special privileges, and 4720/4728 account and group changes, which are essential for detecting credential theft, lateral movement, and privilege escalation tied to identity compromise. SigninLogs (B) is correct because it holds Microsoft Entra ID sign-in telemetry including result type, conditional access status, risk detections, IP/location, and MFA details, directly exposing brute-force, password spray, impossible travel, and token replay activity. AuditLogs (D) is correct because it records Entra ID directory changes such as role assignments, consent grants, credential additions, and user/group modifications that attackers use to persist or escalate after compromising an identity. CommonSecurityLog (C) is not among the correct answers because it carries third-party CEF/Syslog data (firewalls, proxies, IDS) rather than native identity authentication events. OfficeActivity (E) is not among the correct answers because it reflects Microsoft 365 workload operations (SharePoint, Exchange, Teams) and, while useful for post-compromise activity, is less directly focused on identity compromise than the authentication and directory sources.

Answer

CommonSecurityLog

Answer

OfficeActivity

Question 9

Your Microsoft Sentinel workspace ingests logs from Microsoft Defender for Cloud and Microsoft 365 Defender. You need to create an incident response playbook that automatically responds to high-severity incidents. Which THREE components are required? (Choose three.)

Accepted Answer

An analytics rule that generates the incident. Option B is required because an analytics rule is what detects the activity and generates the incident in Microsoft Sentinel; without an incident, there is nothing for the playbook to respond to. Option C is required because an automation rule in Microsoft Sentinel is the mechanism that triggers a playbook automatically when an incident is created, matching conditions such as high severity. Option E is required because the playbook itself is implemented as an Azure Logic Apps workflow that uses the Microsoft Sentinel incident trigger to run the response actions. Option A is not required because a workbook is only a visualization/reporting tool and plays no role in automated incident response. Option D is not required because a hunting query is used for proactive threat hunting, not for automatically triggering a playbook.

Answer

A workbook to visualize the incident data

Answer

A hunting query to search for similar activity

Question 10

Which TWO actions are valid when performing threat hunting in Microsoft Sentinel using hunting queries? (Choose two.)

Accepted Answer

Bookmark specific rows of results for later investigation.. Option A is correct because Microsoft Sentinel hunting queries return results in Logs, and an analyst can select rows and create bookmarks to preserve those findings and pivot them into an investigation. Option B is correct because a hunting query can be converted into a custom analytics rule, which then runs on a schedule and generates incidents/alerts for ongoing detection. Option C is not valid because hunting queries are ad hoc/manual by design; scheduling and alerting are functions of analytics rules, not the hunting query itself. Option D is likewise not valid for hunting queries, since automatic alerting on query results requires an analytics rule. Option E is not a built-in hunting-query action; exporting to Azure Blob Storage would require separate tooling or workflows, not a native hunting query operation.

Answer

Schedule a hunting query to run every hour.

Answer

Automatically trigger an alert when a hunting query returns results.

Answer

Export results directly to Azure Blob Storage.

Question 11

Which TWO are valid methods for performing threat hunting in Microsoft Sentinel? (Choose two.)

Accepted Answer

Using the Hunting blade with built-in queries. Option B is correct because the Hunting blade in Microsoft Sentinel provides built-in, pre-designed hunting queries (based on KQL) that analysts can run across Log Analytics workspaces to proactively search for suspicious activity, which is a core threat-hunting method. Option D is correct because Microsoft Sentinel supports Jupyter notebooks integrated with MSTICpy, a Python library that enables advanced, customizable threat-hunting workflows such as querying logs, enriching data with threat intelligence, and visualizing results. Option A is not a hunting method but an automated incident-response capability (playbooks built on Logic Apps). Option C is incorrect because the MITRE ATT&CK dashboard/page in Sentinel is used for coverage mapping and understanding detections, not as a primary threat-hunting technique. Option E is incorrect because watchlists are used to store reference data (e.g., IPs, users) for correlation and can drive analytics rules, but creating alerts from watchlists is detection engineering, not threat hunting.

Answer

Using playbooks to respond to incidents

Answer

Using the MITRE ATT&CK dashboard

Answer

Using watchlists to create alerts

Question 12

Which THREE techniques are effective for hunting for living-off-the-land (LotL) attacks using Microsoft Sentinel?

Accepted Answer

Hunting for WMI activity using Event ID 5861 and correlating with process creation events.. Option B is correct because WMI is a native Windows administration mechanism frequently abused for LotL execution and persistence, and Event ID 5861 (WMI permanent event subscription creation in the WMI-Activity operational log) combined with process creation telemetry (e.g., Event ID 4688/Sysmon Event ID 1) exposes malicious subscription-based persistence and spawned processes. Option D is correct because PowerShell script block logging (Event ID 4104) captures de-obfuscated script content, making it effective for detecting encoded commands (-EncodedCommand), download cradles, and unusual parameters typical of LotL tradecraft. Option E is correct because correlating service installation (System log Event ID 7045) with subsequent network connections from administrative tools such as PsExec, sc.exe, or SMB/RPC traffic reveals lateral movement and remote execution that rely on built-in utilities. Option A does not belong because installing third-party software is not living-off-the-land activity, which by definition uses pre-installed, signed system binaries. Option C does not belong because Logon Type 5 is a service logon, and while service accounts can be abused, tracking non-interactive service logons alone is not a specific or effective LotL hunting technique compared with the correlated event-based methods above.

Answer

Monitoring for installation of third-party software on endpoints.

Answer

Tracking non-interactive logon sessions (Logon Type 5).

Question 13

Which THREE are essential components of a threat hunting hypothesis in Microsoft Sentinel? (Choose three.)

Accepted Answer

Adversary goal or objective. A threat hunting hypothesis in Microsoft Sentinel must be structured around what the adversary is trying to achieve, so option A (Adversary goal or objective) is correct because it defines the behavior or intent being tested, such as credential theft or lateral movement, which guides the entire hunt. Option C (Data sources to query) is correct because a hypothesis is only actionable if it maps to concrete telemetry in Sentinel, such as SecurityEvent, Syslog, SigninLogs, or OfficeActivity tables queried via KQL, so the hunter knows where to look. Option E (Expected indicators of compromise (IOCs)) is correct because the hypothesis must specify the observable artifacts that would confirm or refute it, such as specific process names, IP addresses, hashes, or anomalous sign-in patterns, enabling validation of the hunt. Option B (Alert severity level) is not essential because severity is a triage attribute of analytics rules and incidents, not a defining element of a hunting hypothesis. Option D (Automated response plan) is not essential because automation and playbooks belong to incident response and SOAR workflows, whereas threat hunting is an investigative, hypothesis-driven activity that may not trigger automated actions.

Answer

Alert severity level

Answer

Automated response plan

Question 14

Which TWO of the following are valid methods to detect Kerberoasting attacks during a threat hunt? (Select TWO.)

Accepted Answer

Service account logon events with RC4 encryption type.. Option A is correct because Kerberoasting requests TGS tickets for service accounts and the attacker typically requests RC4 (etype 0x17) encryption to make offline cracking of the service account hash easier, so service account logon events showing RC4 encryption (Event ID 4769 with Ticket Encryption Type 0x17) are a strong hunting indicator. Option B is correct because a single user account rapidly requesting multiple TGS tickets for many different service accounts (SPNs) is a hallmark of automated Kerberoasting enumeration and ticket harvesting. Option C is not specific to Kerberoasting, since LDAP query volume anomalies can reflect many other reconnaissance or administrative activities. Option D concerns NTLM authentication failures, which are unrelated to Kerberos TGS abuse. Option E describes Golden Ticket detection, which involves forged TGTs and KRBTGT compromise, not Kerberoasting's TGS request behavior.

Answer

Unusual number of LDAP queries from a domain controller.

Answer

High volume of NTLM authentication failures from a single IP.

Answer

Detection of forged Kerberos tickets (Golden Ticket) in the domain.

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A new security policy requires that all incidents involving 'Credential Access' tactics be automatically assigned to the Tier 1 SOC team and have a severity of 'High'. You need to configure this automation. What should you do?

Accepted Answer

Create an automation rule in Microsoft Sentinel with conditions for tactic 'Credential Access' and actions to assign to Tier 1 SOC and set severity to High.. Automation rules in Microsoft Sentinel allow you to define conditions based on incident properties, such as tactic, and then trigger actions like assigning the incident to a specific owner (Tier 1 SOC) and setting the severity. This directly meets the policy requirement without requiring external playbooks or modifying analytics rules.

Answer

Configure an automated investigation rule in Microsoft Defender XDR to assign incidents.

Answer

Create a playbook in Microsoft Sentinel that runs on incident creation and assigns the incident to Tier 1 SOC.

Answer

Modify the analytics rule that generates the incidents to include the assignment and severity settings.

Question 16

You are an incident responder for a company using Microsoft 365 Defender. A critical incident is assigned to you. What is the first action you should take according to best practices?

Accepted Answer

Triage the incident to determine the scope and severity.. The first and most critical step in incident response is to triage the incident. Triage involves assessing the incident's scope, severity, and potential impact to prioritize and guide subsequent actions. Without triage, you risk wasting resources on low-priority issues or taking inappropriate steps. Option A is correct because it enables informed decision-making. Option B (escalate) should come after triage if necessary. Option C (isolate devices) may be too hasty and could hinder investigation. Option D (collect memory dump) is premature before understanding the incident.

Answer

Escalate the incident to senior management.

Answer

Immediately isolate all affected devices.

Answer

Collect a full memory dump from the affected systems.

Question 17

Your organization uses Microsoft Sentinel. A security incident related to a compromised user account has been fully investigated and remediated. Which THREE steps should you take to close the incident properly? (Choose three.)

Accepted Answer

Verify that all related alerts are resolved or closed.. Options A, C, and D are correct. Verifying that all related alerts are resolved or closed (A) ensures no lingering issues. Changing the incident status to Closed with an appropriate classification (C) provides proper closure. Adding comments summarizing the investigation and remediation steps (D) documents the process. Option B (creating a new analytics rule) is not required for closing an incident. Option E (deleting the incident) is not recommended; incidents should be closed, not deleted.

Answer

Create a new analytics rule to detect similar activity.

Answer

Delete the incident to clean up the workspace.

Question 18

A security analyst is investigating a ransomware incident and needs to find all files that were written to a specific device within a 5-minute window before the ransomware process started. The analyst knows the device name and the ransomware process start time. Which advanced hunting table and KQL operator combination would be most efficient to find the file creation events?

Accepted Answer

DeviceFileEvents with where. DeviceFileEvents is the correct table because it specifically captures file creation, modification, and deletion events on devices. Using the `where` operator to filter by device name and a timestamp range (5 minutes before the ransomware process start time) is the most efficient way to retrieve the exact file creation events needed for the investigation.

Answer

DeviceProcessEvents with join

Answer

DeviceEvents with where

Answer

DeviceImageLoadEvents with where

Question 19

Which TWO of the following are valid data connectors for Microsoft Sentinel? (Select TWO.)

Accepted Answer

Azure Firewall. Azure Firewall and Microsoft Entra ID are both supported data connectors in Microsoft Sentinel. Azure Firewall can be connected via the Azure Firewall connector, and Microsoft Entra ID (formerly Azure Active Directory) has built-in connectors for auditing and sign-in logs. Docker containers (A) are not a native data source for Sentinel; they would require a custom solution. Amazon RDS (B) is not directly supported; you would need to ingest via AWS CloudTrail or similar. Google Cloud Storage (D) also requires custom ingestion methods.

Answer

Docker containers

Answer

Amazon RDS

Answer

Google Cloud Storage

Question 20

A security analyst is investigating a malware incident on an endpoint using Microsoft 365 Defender. The analyst wants to see all processes that were created on the device in the last hour, including the command line arguments. Which advanced hunting table should they query?

Accepted Answer

DeviceProcessEvents. The DeviceProcessEvents table in Microsoft 365 Defender's advanced hunting schema captures process creation events, including the command line arguments used to start each process. This directly meets the analyst's need to see all processes created in the last hour with their command-line details, making it the correct table for investigating malware that spawns processes.

Answer

DeviceNetworkEvents

Answer

DeviceFileEvents

Answer

DeviceRegistryEvents