SC-200 Mock Exam 78 — 25 Questions

Question 1

You are threat hunting for signs of credential dumping using Mimikatz. In Microsoft Defender for Identity, which type of alert would you expect to see?

Accepted Answer

Suspicious service creation. Option A is correct because 'Suspicious service creation' can indicate Mimikatz installation. Option B is wrong because 'Brute force' is different. Option C is wrong because 'Pass-the-Hash' is a related but distinct technique. Option D is wrong because 'Reconnaissance' is not specific.

Answer

Pass-the-Hash attack

Answer

Reconnaissance using SMB

Answer

Brute force attack

Question 2

Which TWO KQL operators are commonly used in threat hunting to join tables based on a key?

Accepted Answer

lookup. Join and lookup are both used to combine tables based on keys. Union combines rows, summarize aggregates, extend adds columns.

Answer

extend

Answer

summarize

Answer

union

Question 3

Your threat hunt reveals a series of failed logon attempts from a single IP address across multiple user accounts. Which Microsoft Sentinel analytic rule template is best suited to alert on this brute-force pattern?

Accepted Answer

Brute force attack against a user account. Option D is correct because the 'Brute force attack against a user account' rule specifically detects multiple failed logons. Option A is for malware. Option B is for anomalous logons by geo. Option C is for password spray across users.

Answer

Malware detected in network traffic

Answer

Password spray attack

Answer

Anomalous logon location

Question 4

A threat hunter wants to proactively identify devices that may have been compromised by a known adversary using DLL side-loading techniques. Which Microsoft Sentinel solution or feature should the hunter leverage to create custom detection rules based on the latest threat intelligence?

Accepted Answer

Threat Intelligence integration with analytics rules. Option B is correct because Microsoft Sentinel's Threat Intelligence integration allows importing TI indicators and creating analytics rules. Option A is wrong because UEBA focuses on user behavior, not specific TI. Option C is wrong because workbook is for visualization, not detection. Option D is wrong because playbook is for response automation.

Answer

User and Entity Behavior Analytics (UEBA)

Answer

Automation rules with playbooks

Answer

Custom workbooks

Question 5

Which TWO of the following are recommended practices when performing threat hunting in Microsoft Sentinel? (Choose 2)

Accepted Answer

Create custom hunting queries based on hypothesis. Options B and D are correct. Option B: Using watchlists to store known indicators helps in matching. Option D: Creating custom hunting queries is essential for proactive hunting. Option A is wrong because disabling alerts would miss possible incidents. Option C is wrong because deleting data reduces hunting scope. Option E is wrong because manual analysis is necessary alongside automation.

Answer

Rely solely on automated detection rules

Answer

Disable all built-in analytics rules to avoid noise

Answer

Delete log data older than 30 days to improve query performance

Question 6

Which TWO actions are valid when performing threat hunting in Microsoft Sentinel using hunting queries? (Choose two.)

Accepted Answer

Bookmark specific rows of results for later investigation.. Option A is correct because you can bookmark results for later investigation. Option C is correct because you can create a custom detection rule from a hunting query. Option B is wrong because hunting queries do not automatically trigger alerts; they are manual. Option D is wrong because you cannot directly export results to Azure Storage, only to a CSV file or Log Analytics. Option E is wrong because you cannot schedule a hunting query to run automatically; you would need to create an analytics rule.

Answer

Schedule a hunting query to run every hour.

Answer

Automatically trigger an alert when a hunting query returns results.

Answer

Export results directly to Azure Blob Storage.

Question 7

While hunting for lateral movement, you want to find out which devices have established remote PowerShell sessions to other devices. Which Microsoft Defender for Endpoint advanced hunting table should you query?

Accepted Answer

DeviceNetworkEvents. Option B is correct because DeviceNetworkEvents contains network connections that can indicate remote PowerShell sessions (port 5985/5986). Option A is incorrect because DeviceProcessEvents shows process creation, not network connections. Option C is incorrect because DeviceEvents shows general events. Option D is incorrect because DeviceLogonEvents shows logon events, not network sessions.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

DeviceLogonEvents

Question 8

A security analyst is reviewing a threat hunting query in Microsoft Sentinel that uses the Kusto Query Language (KQL) to identify potential lateral movement. The query returns a large number of false positives. What is the most effective way to reduce false positives while maintaining detection coverage?

Accepted Answer

Add allowlist conditions to exclude known administrative tools.. Option B is correct because adding allowlist conditions, such as excluding known administrative tools or approved remote management traffic, directly reduces false positives without removing the core logic. Option A is wrong because reducing the time range may miss true positives. Option C is wrong because the question asks to maintain detection coverage, and using a less sensitive data source would reduce coverage. Option D is wrong because increasing the threshold may also miss true positives.

Answer

Increase the threshold for the anomaly score in the query.

Answer

Reduce the time range of the query to the last 1 hour.

Answer

Replace the query with a different data source that has less noise.

Question 9

Which THREE techniques are commonly used in Microsoft Sentinel threat hunting to identify command and control (C2) communication? (Select THREE.)

Accepted Answer

Detecting DNS tunneling. Options A, B, and E are correct because analyzing beaconing patterns, detecting DNS tunneling, and examining SSL/TLS certificates are common C2 detection methods. Option C is wrong because brute force detection is for credential attacks, not C2. Option D is wrong because analyzing email headers is for phishing, not C2.

Answer

Analyzing email headers for phishing

Answer

Identifying brute force attempts

Question 10

During a threat hunt, you identify a user account that has been logging in from multiple geographic regions within a short time. Which Microsoft Defender for Cloud Apps feature should you use to investigate this anomaly?

Accepted Answer

Activity log. Option B is correct because the activity log provides detailed user activities including location. Option A is wrong because App permissions is for OAuth apps. Option C is wrong because file policy is for data protection. Option D is wrong because Cloud Discovery is for shadow IT, not user login anomalies.

Answer

Cloud Discovery

Answer

App permissions

Answer

File policy

Question 11

During a threat hunting exercise in Microsoft Sentinel, you want to identify all cloud application events where a user accessed a resource from an IP address not previously associated with that user. Which KQL operator should you use to compare current access patterns with a baseline of known IPs?

Accepted Answer

join. The `join` operator allows combining two tables based on a key, such as UserId, and then filtering for rows where the IP does not match the baseline.

Answer

lookup

Answer

summarize

Answer

union

Question 12

Which THREE data sources in Microsoft Sentinel are most useful for threat hunting activities related to identity compromise?

Accepted Answer

SecurityEvent. SigninLogs (Azure AD), AuditLogs (Azure AD), and SecurityEvent (Windows) provide identity-related data. CommonSecurityLog is for network appliances, OfficeActivity for M365 workloads.

Answer

CommonSecurityLog

Answer

OfficeActivity

Question 13

You are threat hunting for signs of Kerberoasting in Microsoft Sentinel. Which combination of events indicates that a service account's Kerberos ticket was requested and then used?

Accepted Answer

Event ID 4769 (Kerberos Service Ticket Request) followed by Event ID 4624 (An account was logged on). Option A is correct because Kerberoasting involves TGS requests (4769) followed by service logon (4624). Option B is for AS requests. Option C is for account lockout. Option D is for ticket renewal.

Answer

Event ID 4770 (Kerberos Ticket Renewal) followed by Event ID 4634 (Logoff)

Answer

Event ID 4740 (Account Lockout) followed by Event ID 4625 (Failed Logon)

Answer

Event ID 4768 (Kerberos Authentication Ticket) followed by Event ID 4776 (Credential Validation)

Question 14

Your threat hunting team uses Microsoft Sentinel. They want to search for anomalous network connections to known malicious IP addresses over the past 7 days. Which KQL operator should they use to match the source IP addresses against a watchlist containing the malicious IPs?

Accepted Answer

in. Option A is correct because the `in` operator checks if a value exists in a list or dynamic array. Option B is wrong because `has` is for string containment, not list membership. Option C is wrong because `where` is a clause, not an operator for list matching. Option D is wrong because `contains` is for substring matching.

Answer

where

Answer

has

Answer

contains

Question 15

You are reviewing a hunting query. What is the primary purpose of this query?

Accepted Answer

Find users with medium-risk sign-ins that share IP addresses with service principal sign-ins, indicating possible token theft or lateral movement. Option C is correct because the query filters for users with medium risk sign-ins and joins with service principal sign-ins on IP address, then counts occurrences per user exceeding 5, indicating potential compromise involving both user and service principal activity from the same IP. Option A is wrong because it does not focus on service principal compromise alone. Option B is wrong because it does not look for admin consent grants. Option D is wrong because it uses only medium risk, not high.

Answer

List all users with any risk level during sign-in in the last 7 days

Answer

Detect users who have granted admin consent to malicious OAuth apps

Answer

Identify service principals that have been compromised and are performing high-risk sign-ins

Question 16

Which THREE data sources can be used in Microsoft Sentinel for threat hunting to detect unusual authentication patterns? (Choose three.)

Accepted Answer

SecurityEvent (Windows Event Logs). Option A is correct because SigninLogs from Microsoft Entra ID contain authentication data. Option B is correct because SecurityEvent (Windows Event Log) contains logon events. Option D is correct because AADNonInteractiveUserSignInLogs contain non-interactive sign-ins. Option C is wrong because OfficeActivity contains audit logs, not authentication. Option E is wrong because CommonSecurityLog is for network devices, not authentication.

Answer

CommonSecurityLog

Answer

OfficeActivity (Office 365)

Question 17

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During a threat hunt, you want to identify AWS resources that have been compromised by correlating AWS CloudTrail logs with Microsoft Defender for Cloud security alerts. How should you ingest AWS CloudTrail logs into Microsoft Sentinel?

Accepted Answer

Use the AWS S3 connector in Microsoft Sentinel.. Option A is correct because AWS CloudTrail logs can be ingested via the AWS S3 connector in Microsoft Sentinel. Option B is incorrect because Microsoft Defender for Cloud does not natively ingest CloudTrail logs. Option C is incorrect because Azure Policy cannot ingest AWS logs. Option D is incorrect because the Microsoft 365 Defender connector is for Microsoft 365 data, not AWS.

Answer

Configure Microsoft Defender for Cloud to receive AWS CloudTrail logs.

Answer

Use the Microsoft 365 Defender connector to ingest CloudTrail logs.

Answer

Use Azure Policy to export CloudTrail logs to Log Analytics.

Question 18

During a threat hunting exercise, an analyst discovers a suspicious PowerShell process that executed encoded commands and made outbound connections to an unknown IP address. The process tree shows it was spawned by a Microsoft Word instance. What is the most likely attack technique being observed?

Accepted Answer

Phishing with malicious macro. Option B is correct because the scenario describes a malicious document (Word) executing PowerShell with encoded commands, which is classic phishing with macro-based payload. Option A is wrong because execution via rundll32 is not indicated. Option C is wrong because the attack originates from a document, not a service. Option D is wrong because there is no evidence of lateral movement.

Answer

Service Execution

Answer

Execution via Rundll32

Answer

Lateral Movement via WMI

Question 19

Which THREE actions should a threat hunter take when using Microsoft Defender XDR advanced hunting to investigate a potential ransomware outbreak? (Select THREE.)

Accepted Answer

Check for service installation events that mimic system services.. Options A, C, and E are correct because correlating process creation with file modifications, inspecting scheduled tasks, and checking for service installation are key steps to identify ransomware behavior. Option B is wrong because reviewing mailbox audit logs is not relevant for ransomware on endpoints. Option D is wrong because reviewing password changes is not directly related to ransomware.

Answer

Review mailbox audit logs for email forwarding rules.

Answer

Review password change events for service accounts.

Question 20

You are investigating a potential data exfiltration using Microsoft Defender for Cloud Apps. You find that a user downloaded a large number of files from SharePoint Online to a personal device. Which anomaly detection policy type would have detected this?

Accepted Answer

Activity anomaly detection policy. Option C is correct because Activity anomaly detection policies detect unusual download volumes. Option A is wrong because File anomaly policies focus on file types and metadata. Option B is wrong because OAuth app anomaly policies focus on app permissions. Option D is wrong because Cloud Discovery anomaly policies focus on shadow IT.

Answer

File anomaly detection policy

Answer

Cloud Discovery anomaly detection policy

Answer

OAuth app anomaly detection policy