SC-200 Mock Exam 81 — 25 Questions

Question 1

During a threat hunt, you identify a suspicious process execution chain in Microsoft Defender for Endpoint: `powershell.exe` spawned `cmd.exe` which then executed `rundll32.exe`. To investigate the parent-child relationships, which KQL statement should you use in Advanced Hunting?

Accepted Answer

DeviceProcessEvents | where ProcessChain has_all ("powershell.exe", "cmd.exe", "rundll32.exe"). The `make_list` function with `ProcessChain` parameter can construct the process chain, but the standard approach is to use `DeviceProcessEvents` and join on `InitiatingProcessFileName` and `FileName`. However, the correct answer involves using `scan` or `join`. Actually, the best practice is to use the `ProcessChain` column if available, or use `make_list`. Option C is the most direct.

Answer

DeviceProcessEvents | where FileName == "rundll32.exe" and InitiatingProcessFileName == "cmd.exe"

Answer

DeviceProcessEvents | summarize by ProcessChain

Answer

DeviceProcessEvents | where FileName == "powershell.exe" | join kind=inner DeviceProcessEvents on $left.DeviceId == $right.DeviceId

Question 2

A threat hunter wants to identify all devices that have communicated with a known malicious IP address in the last 7 days. Which table in Microsoft Defender for Endpoint advanced hunting should be queried?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents records network connections, including destination IP addresses.

Answer

DeviceFileEvents

Answer

DeviceProcessEvents

Answer

DeviceRegistryEvents

Question 3

Your threat hunt identifies a process that is making outbound connections to an unknown IP address. Which Microsoft Defender for Endpoint action can you take to immediately isolate the device?

Accepted Answer

Isolate device. Option A is correct because Isolate device disconnects the device from the network. Option B only runs a scan. Option C collects investigation package. Option D blocks the file but doesn't isolate.

Answer

Collect investigation package

Answer

Block file

Answer

Run antivirus scan

Question 4

Refer to the exhibit. The KQL query is used in a threat hunting campaign. Which of the following best describes the hunting activity this query is designed to detect?

Accepted Answer

Macro-based PowerShell execution from Office documents. Option A is correct because the query detects PowerShell launched from Microsoft Office applications, which is a common technique for macro-based attacks. Option B is incorrect because the query does not filter by encoded command. Option C is incorrect because it does not look for lateral movement. Option D is incorrect because there is no external IP or network connection in the query.

Answer

Encoded PowerShell commands executed from the command line

Answer

Lateral movement using PowerShell remoting

Answer

Data exfiltration via PowerShell over HTTP

Question 5

You are reviewing a custom analytics rule in Microsoft Sentinel. The rule is enabled but you notice that no alerts have been generated even though there are many matching events. What is the most likely cause?

Accepted Answer

The triggerThreshold of 5 requires at least 5 matching events in each hour.. The rule suppresses alerts for 5 hours after an alert is generated. Since suppression is enabled (suppressionEnabled: true? Actually the value is false, but the duration is set. Wait, suppressionEnabled is false, so suppression is disabled. However, the queryFrequency and queryPeriod are both 1 hour, and triggerThreshold is 5. If there are many matching events, the threshold might not be met if events are spread out. But the exhibit shows suppressionEnabled: false, so suppression is not the issue. The most likely cause is that the rule has a triggerThreshold of 5, meaning it requires at least 5 events in the query period. If there are fewer than 5, no alert is generated.

Answer

The rule is not associated with a data connector.

Answer

The queryPeriod is too short to capture events.

Answer

The rule is suppressed due to suppressionDuration of 5 hours.

Question 6

You are conducting a threat hunt to find evidence of credential dumping on Windows servers. Which event ID in Windows Security Event Log (SecurityEvent) is most indicative of LSASS process access?

Accepted Answer

4656 (Handle to an object requested). Event ID 4656 is generated when a handle to an object (like LSASS) is requested, often used in credential dumping.

Answer

4688 (Process creation)

Answer

4672 (Special privileges assigned)

Answer

4624 (Logon)

Question 7

You are reviewing a custom hunting query in Microsoft Sentinel. The query above returns results, but you suspect it misses low-frequency beaconing. Which modification improves detection while reducing false positives?

Accepted Answer

Use a sliding window to count distinct connection times per IP per device. Option C is correct because time-bounded connections better detect regular beaconing. Option A increases false positives. Option B only adds columns. Option D counts per device, missing cross-device patterns.

Answer

Group by DeviceName only

Answer

Decrease the count threshold to 10

Answer

Add RemotePort to the summarize clause

Question 8

During a threat hunt, you notice an anomalous number of failed logon attempts from a single IP address across multiple user accounts in Microsoft Entra ID sign-in logs. What is the most effective next step to determine if this is a brute-force attack?

Accepted Answer

Correlate with successful logon events from the same IP for those accounts. Option B is correct because correlating failed logons with successful ones from the same IP helps confirm if the attacker eventually succeeded. Option A is incorrect as blocking prematurely may not be justified. Option C is incorrect as resetting passwords does not address the source. Option D is incorrect as disabling accounts may impact legitimate users.

Answer

Immediately block the IP address in the firewall

Answer

Reset passwords for all affected accounts

Answer

Disable the accounts that had failed logons

Question 9

Which TWO of the following KQL operators are most useful when building hunting queries to detect anomalous activities over time?

Accepted Answer

summarize. Options A and C are correct. summarize with bin() is fundamental for time-series analysis to detect anomalies. make_list() is often used with summarize to aggregate events per time period for anomaly detection. Option B is incorrect because extend creates new columns but does not directly help with time-based detection. Option D is incorrect because where filters rows but does not detect anomalies over time. Option E is incorrect because project selects columns.

Answer

where

Answer

project

Answer

extend

Question 10

You are a security analyst using Microsoft Sentinel. During a threat hunt, you need to identify potential data exfiltration via DNS tunneling. You have DNS query logs ingested from your DNS servers via Syslog. The log schema includes fields: TimeGenerated, QueryName, QueryType, ClientIP, ResponseIP. You want to find DNS queries that are unusually long (over 50 characters in the query name) and have a high count of unique responses, which may indicate tunneling. You need to write a KQL query that returns the top 10 client IPs with the most unique response IPs for queries with query name length > 50 in the last 24 hours. Which query should you use?

Accepted Answer

Syslog | where TimeGenerated > ago(24h) | extend QueryNameLength = strlen(QueryName) | where QueryNameLength > 50 | summarize dcount(ResponseIP) by ClientIP | top 10 by dcount_ResponseIP. Option A correctly filters for long query names, summarizes distinct ResponseIPs per ClientIP, and orders by dcount. Option B counts all responses, not unique. Option C uses wrong field. Option D does not filter length.

Answer

Answer

Answer

Syslog | where TimeGenerated > ago(24h) | summarize dcount(ResponseIP) by ClientIP | top 10 by dcount_ResponseIP

Question 11

During a threat hunt, you identify a suspicious process that spawned from Microsoft Word with a command-line argument containing ' -enc '. Which hunting technique is most appropriate to investigate this further?

Accepted Answer

Decode the base64-encoded command-line argument. Option B is correct because base64-encoded command lines are commonly used in malicious documents to obfuscate payloads. Decoding the argument reveals the intended command. Option A is incorrect because decoding is not limited to PowerShell. Option C is incorrect because network traffic analysis may follow but is not the immediate next step. Option D is incorrect because file hash lookup is less relevant for the encoded command.

Answer

Review the PowerShell script block logging

Answer

Initiate network traffic analysis for the host

Answer

Check the file hash against threat intelligence feeds

Question 12

Which THREE of the following are indicators of a potential pass-the-hash attack that a threat hunter should investigate in Microsoft Defender for Identity?

Accepted Answer

Multiple failed logon attempts followed by a successful logon from the same IP. Options A, B, and C are correct. Anomalous NTLM authentication from a domain controller is suspicious because DCs typically do not initiate NTLM requests. Multiple failed logon attempts followed by a success from the same IP indicates credential reuse. Event ID 4624 with logon type 9 (NewCredentials) often indicates pass-the-hash. Option D is incorrect because TGS requests are related to Kerberos, not pass-the-hash. Option E is incorrect because high resource usage is not specific to pass-the-hash.

Answer

High volume of TGS requests from a single user

Answer

Anomalous spike in CPU usage on domain controllers

Question 13

You are threat hunting in Microsoft Defender XDR for signs of Kerberoasting. Which hunting query would be most effective in identifying Kerberoasting activity?

Accepted Answer

IdentityQueryEvents | where QueryTarget like 'TGS' | summarize count() by InitiatingAccount, IPAddress | where count_ > 10. Option C is correct because Kerberoasting typically involves anomalous requests for Kerberos service tickets (TGS) by a single user to many services. Option A is incorrect because failed logins are not specific to Kerberoasting. Option B is incorrect because it focuses on service accounts, not the attacker's activity. Option D is incorrect because ticket decryption failures are not the primary indicator.

Answer

IdentityDirectoryEvents | where AccountDomain == 'Service Accounts'

Answer

IdentityLogonEvents | where Application == 'Kerberos' and Result == 'Failed'

Answer

IdentityLogonEvents | where LogonType == 'Failed'

Question 14

You are a security operations analyst for Contoso Ltd. The company uses Microsoft Sentinel as its SIEM and Microsoft Defender for Cloud Apps for SaaS security. You are tasked with threat hunting for potential data exfiltration via Microsoft SharePoint Online. You need to create a hunting query that identifies users who have downloaded an unusually high number of files from SharePoint within a short time window compared to their historical baseline. The query should be run in Microsoft Sentinel using the OfficeActivity table. Which of the following approaches should you take?

Accepted Answer

Query the OfficeActivity table, filter for Operation=='FileDownloaded', summarize by UserId and bin(TimeGenerated, 1h), then use a join with a historical baseline table to detect deviations. Option A is correct because using the OfficeActivity table with summarize and bin() allows you to count download events (Operation=='FileDownloaded') per user per hour and then compare the current count to a historical average to detect anomalies. Option B is incorrect because the CommonSecurityLog table does not contain SharePoint download events. Option C is incorrect because the HuntingBookmark table is for storing bookmarks, not for running analytics. Option D is incorrect because the SecurityAlert table contains alerts, not raw events needed for baseline calculation.

Answer

Use the HuntingBookmark table to search for user activity

Answer

Query the CommonSecurityLog table for SharePoint events and look for high volumes of outbound traffic

Answer

Query the SecurityAlert table for alerts related to data exfiltration

Question 15

You are threat hunting for indicators of compromise related to a known malware family. Which data source in Microsoft Defender XDR would provide the most direct evidence of malware execution on endpoints?

Accepted Answer

DeviceProcessEvents. Option C is correct because DeviceProcessEvents captures process creation events, which directly indicate malware execution. Option A is incorrect because EmailEvents only covers email, not execution. Option B is incorrect because DeviceNetworkEvents shows network connections after execution. Option D is incorrect because IdentityLogonEvents focuses on authentication.

Answer

EmailEvents

Answer

IdentityLogonEvents

Answer

DeviceNetworkEvents

Question 16

You are a threat hunter at Northwind Traders. The organization uses Microsoft Defender for Identity (MDI) and Microsoft Sentinel. You suspect a golden ticket attack may have occurred in the domain. You need to create a hunting query in Microsoft Sentinel that leverages data from MDI to detect possible golden ticket usage. Which of the following queries or approaches is most appropriate?

Accepted Answer

Query SecurityAlert where AlertName contains 'Golden Ticket' or 'Suspicious Kerberos'. Option B is correct because golden ticket attacks often involve anomalous Kerberos service ticket requests that are not preceded by an authentication request. MDI generates alerts for such anomalies, which are stored in the SecurityAlert table. Option A is incorrect because DeviceProcessEvents is for endpoints, not authentication servers. Option C is incorrect because IdentityLogonEvents may contain logon events but not specifically golden ticket indicators. Option D is incorrect because CommonSecurityLog is for network devices.

Answer

Query DeviceProcessEvents for processes related to Kerberos

Answer

Query CommonSecurityLog for unusual DNS queries related to Kerberos

Answer

Query IdentityLogonEvents for failed Kerberos authentication

Question 17

In a threat hunt, you discover that a non-admin user account created a scheduled task that executes a PowerShell script to connect to an external IP on port 4444. Which of the following is the most likely interpretation of this activity?

Accepted Answer

The scheduled task is likely a reverse shell for persistence and remote access. Option D is correct because PowerShell connecting to an external IP on a non-standard port like 4444 is indicative of a reverse shell. Option A is incorrect because standard admin tasks typically use RDP or WinRM. Option B is incorrect because port 4444 is not typically used for updates. Option C is incorrect because remote assistance uses different ports and protocols.

Answer

The user is performing legitimate remote administration

Answer

The PowerShell script is a remote assistance tool

Answer

The scheduled task is part of a software update mechanism

Question 18

Which TWO of the following are valid methods to initiate a threat hunting session in Microsoft Sentinel?

Accepted Answer

Start from a specific detection rule. Starting from a specific detection rule and using a predefined hunting query are both valid methods. Live mode is not a feature; custom analytics rules are for detection, not hunting; and watchlists are used for enrichment, not for initiating hunting.

Answer

Create a custom analytics rule

Answer

Import a watchlist as a hunting query

Answer

Enable live mode on a hunting query

Question 19

While threat hunting in Microsoft Sentinel, you want to create a hunting query that identifies all attempts to disable security controls. Which data table would be most appropriate to query for such activity?

Accepted Answer

SecurityEvent. Option A is correct because SecurityEvents (Windows Event Logs) contain events like 4688 (process creation) and 4689 (process termination) which can show attempts to stop security services. Option B is incorrect because CommonSecurityLog is for firewall logs. Option C is incorrect because Syslog is for Linux events. Option D is incorrect because OfficeActivity is for Office 365.

Answer

Syslog

Answer

CommonSecurityLog

Answer

OfficeActivity

Question 20

Which THREE actions are part of the threat hunting process in Microsoft Defender XDR?

Accepted Answer

Investigate entities found in the results. Formulating a hypothesis, querying advanced hunting, and investigating entities are core steps. Configuring automated responses is part of incident response, and setting retention policies is data management.

Answer

Configure automated response actions

Answer

Set data retention policies for hunting data