SC-200 Perform threat hunting — 100 Questions

Question 1

A security analyst is using KQL in Microsoft Sentinel to hunt for potential data exfiltration by a user who has been sending unusually large amounts of data to an external IP address. Which KQL operator should the analyst use to identify the top source IP addresses and total bytes sent over the last 7 days?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

... | summarize TotalBytes=sum(SentBytes) by SourceIP | top 10 by TotalBytes desc. The correct operator is summarize with sum() aggregation to compute total bytes per source IP, then top 10 by TotalBytes to identify the top source IPs. Option D correctly uses summarize ... sum(SentBytes) ... by SourceIP | top 10 by TotalBytes desc. Option A (where) filters but does not aggregate. Option B (extend) adds a computed column but does not summarize. Option C (project) only selects columns without aggregation or sorting by total.

Answer

... | where SentBytes > 1000000 | project SourceIP, SentBytes

Answer

... | extend TotalBytes=SentBytes | summarize count() by SourceIP

Answer

... | project SourceIP, SentBytes | sort by SentBytes desc

Question 2

A threat hunter is using Microsoft Defender for Endpoint advanced hunting to investigate a suspicious process that was observed launching from a temporary folder. The hunter wants to find all devices that have executed this specific process (with the same SHA256 hash) in the last 24 hours. Which table and column should be used in the query?

Accepted Answer

DeviceProcessEvents table, SHA256 column. DeviceProcessEvents table tracks process execution events and includes the SHA256 column for the file hash. Therefore, Option C is correct. Option A (DeviceNetworkEvents) is for network connections and does not include SHA256. Option B (DeviceEvents) is a generic table that may not include process hash. Option D (DeviceFileEvents) is for file creation/modification, not execution.

Answer

DeviceNetworkEvents table, SHA256 column

Answer

DeviceEvents table, SHA256 column

Answer

DeviceFileEvents table, SHA256 column

Question 3

During a threat hunt in Microsoft Sentinel, an analyst creates a custom hunting query that uses the 'externaldata' operator to reference a CSV file stored in Azure Blob Storage. The hunt identifies several suspicious IP addresses that need to be added to a threat intelligence indicator. Which method should the analyst use to persist the findings as indicators of compromise (IOCs) for automated alerting?

Accepted Answer

Upload the CSV to a custom threat intelligence feed using the Threat Intelligence - Upload Indicators API. Microsoft Sentinel can ingest threat intelligence from custom CSV files via the Threat Intelligence - Upload Indicators API, allowing the analyst to persist the suspicious IPs as indicators of compromise (IOCs) for automated alerting. Option B (watchlist) is for temporary lookups, not persistent IOCs for detection. Option C (custom analytics rule with inline indicators) does not store the IPs as reusable threat intelligence indicators. Option D (Azure Logic Apps) could automate actions but is not the primary method for persisting IOCs.

Answer

Add the IPs to a Microsoft Sentinel watchlist and reference the watchlist in an analytics rule

Answer

Create a custom analytics rule that includes the IPs as inline indicators

Answer

Use Azure Logic Apps to create a playbook that blocks the IPs automatically

Question 4

A threat hunter is investigating a potential malware outbreak in Microsoft Defender for Cloud Apps. The hunter notices that multiple users have installed a new app with high permissions that accesses their email. The app was not requested by IT. What is the most effective way to hunt for all instances of this app across the organization?

Accepted Answer

Use the Cloud App Security activity log to search for 'Install app' events and then review the 'App governance' dashboard for all instances. The activity log in Cloud App Security provides a comprehensive record of app installation events, and the App Governance dashboard aggregates all instances for review, making it the most effective hunting approach. Option A (conditional access policies) is reactive and not suitable for proactive hunting. Option B (Microsoft 365 Defender alerts) only surfaces known malicious apps, not all instances. Option C (CloudAppEvents table and AppGovernance) can be used, but the activity log is more direct and complete for hunting all installations, as CloudAppEvents may not capture every installation event or may require complex queries.

Answer

Review Conditional Access app control policies for any block rules

Answer

Check Microsoft 365 Defender alerts for malicious OAuth apps

Answer

Query the Microsoft 365 Defender advanced hunting table 'CloudAppEvents' for app installation events and then use 'AppGovernance' to list all apps

Question 5

A threat hunter is using Microsoft Sentinel and Microsoft Defender XDR to hunt for a potential cross-domain attack where an attacker compromised an on-premises server and then used a privileged account to sign into Microsoft 365 from a new IP. The hunter wants to identify the server using a query that combines Windows Event Logs from the server with Microsoft 365 sign-in logs. Which approach should the hunter take to correlate the data?

Accepted Answer

Ingest Windows Security Event logs (Event ID 4624) from the server into a Log Analytics workspace, and join with SigninLogs on account name and timestamp. It directly correlates the on-premises server's Windows Security Event logs (Event ID 4624, which records successful logons with account name and source IP) with Microsoft 365 SigninLogs (Azure AD sign-ins) in a Log Analytics workspace. This allows the hunter to join on the account name and approximate timestamp to identify which server was used to launch the cloud sign-in from a new IP. Option A is wrong because a watchlist of known attacker IPs is static and cannot dynamically correlate server logs with cloud sign-ins. Option B (Sysmon Event ID 3) captures network connections, not logon events, so it won't directly identify the privileged account used. Option D (DeviceLogonEvents) only applies to devices enrolled in Microsoft Defender for Endpoint, not to on-premises servers without MDE, and it doesn't include Microsoft 365 sign-in logs.

Answer

Create a Sentinel watchlist of known attacker IPs and compare with server logs

Answer

Enable Sysmon on the server and use its Event ID 3 (network connection) to find the IP

Answer

Use the DeviceLogonEvents table in Microsoft Defender XDR advanced hunting

Question 6

A threat hunter wants to proactively search for signs of ransomware activity in the environment using Microsoft Sentinel. Which data source is most likely to provide early indicators of ransomware, such as mass file renaming or encryption?

Accepted Answer

Microsoft Defender for Endpoint advanced hunting tables like DeviceFileEvents and DeviceProcessEvents. (Microsoft Defender for Endpoint) provides advanced hunting on endpoint processes and file events, which can detect mass file modifications indicative of ransomware. Option A (Azure AD sign-in logs) logs authentication events. Option C (Azure Activity Log) logs control plane operations. Option D (Office 365 audit logs) logs cloud app activities.

Answer

Azure AD sign-in logs

Answer

Azure Activity Log

Answer

Office 365 audit logs (UnifiedAuditLog)

Question 7

During a threat hunt, an analyst discovers a PowerShell script that was executed on multiple servers in the environment. The script connects to an external IP address and downloads a payload. The analyst wants to find all other servers that may have been compromised by the same script. What is the most efficient way to search for this across the environment?

Accepted Answer

Use the DeviceProcessEvents table in Microsoft Defender for Endpoint advanced hunting to search for the script's SHA256 hash or command line pattern. It leverages Microsoft Defender for Endpoint's advanced hunting to centrally search for the script's SHA256 hash or command line pattern across all endpoints. Option A is incorrect because Sysmon may not be installed on all servers, and querying each server individually is inefficient. Option B is incorrect because network logs only show network connections and do not provide process execution details. Option D is incorrect because querying Event ID 4104 requires enabling PowerShell script block logging and accessing each server individually, which is less efficient than centralized hunting.

Answer

Use Sysmon Event ID 1 (process creation) to find PowerShell executions

Answer

Review the network logs from the firewall for connections to the external IP

Answer

Query the Windows Event Log for Event ID 4104 (PowerShell script block logging) on each server

Question 8

A threat hunter is using Microsoft Sentinel to hunt for a potential advanced persistent threat (APT) that is using living-off-the-land binaries (LOLBins). The hunter creates a KQL query that lists all instances of certutil.exe making network connections. The query returns many legitimate results. What is the best way to reduce false positives while still detecting malicious use?

Accepted Answer

Add additional filters to the query to detect only certutil.exe processes with suspicious command-line arguments (e.g., '-urlcache' or '-split'). Malicious use of certutil.exe as a LOLBin often involves specific command-line arguments such as '-urlcache' or '-split' to download or encode data. By adding these filters to the KQL query, the hunter can reduce false positives from legitimate certutil.exe network connections while still capturing suspicious activity. Option A (Sysmon Event ID 3) still returns all network connections and does not filter on arguments, so it does not reduce false positives. Option B would miss potential threats. Option C expands the query to include all LOLBins, which increases noise and does not target the specific binary in question.

Answer

Replace the query with a Sysmon Event ID 3 (network connect) filter for certutil.exe

Answer

Remove certutil.exe from the hunting query and focus on other binaries

Answer

Expand the query to include all LOLBins that make network connections

Question 9

A threat hunter is using Microsoft Sentinel to hunt for signs of privilege escalation via Azure AD role assignment changes. Which TWO KQL operators or functions are most useful for identifying changes that added a user to a high-privilege role?

Accepted Answer

summarize. The correct answers are D: summarize and E: where. The 'where' operator filters for specific operations like 'Add member to role', which is essential to identify privilege escalation. The 'summarize' operator can count changes per user or role, allowing the analyst to see which users or roles have been modified. Option A (project) only selects columns and does not help with identification. Option B (evaluate) is used for plugin operators and is not relevant here. Option C (mvexpand) expands multi-valued fields, which is not directly useful for this purpose.

Answer

project

Answer

evaluate

Answer

mvexpand

Question 10

A threat hunter is investigating a potential data exfiltration via DNS tunneling using Microsoft Defender for Endpoint advanced hunting. Which THREE columns from the DeviceNetworkEvents table should the hunter include in a query to detect anomalous DNS queries?

Accepted Answer

RemoteUrl. RemoteUrl contains the fully qualified domain name being queried, which is crucial for identifying unusual DNS requests. Timestamp allows analysis of temporal patterns often associated with tunneling. InitiatingProcessFileName identifies the process that generated the query, helping distinguish legitimate from malicious activity. ActionType is not a column in DeviceNetworkEvents (it exists in DeviceEvents). RemoteIP is the destination IP of the DNS server, not the queried domain, and is less relevant for detecting tunneling.

Answer

ActionType

Answer

RemoteIP

Question 11

A security analyst is using Microsoft Sentinel to hunt for signs of a brute-force attack against Azure AD. Which TWO data sources are most relevant for this hunt?

Accepted Answer

SigninLogs. (SigninLogs) contains successful and failed sign-in attempts for interactive user sign-ins. Option E (AADNonInteractiveUserSignInLogs) includes non-interactive sign-ins, which may also be targeted by brute-force attacks. Option A (AzureActivity) logs resource operations, not sign-ins. Option C (OfficeActivity) logs SharePoint and Exchange activities, not sign-ins. Option D (AuditLogs) logs administrative actions, not sign-ins.

Answer

AzureActivity

Answer

OfficeActivity

Answer

AuditLogs

Question 12

A threat hunter runs the KQL query above in Microsoft Sentinel to detect accounts that have experienced multiple failed sign-in attempts due to a disabled account (ResultType 50057) from the same IP. The query returns no results even though the hunter knows that some disabled accounts are being attacked. What is the most likely reason for the false negatives?

Accepted Answer

The time range (1h) is too narrow; the attacks may be spread over several hours. The query uses a time range of only the last hour. If the failed sign-in attempts are spread over a longer period, they will not all be captured within that narrow window, leading to false negatives. Option A is incorrect because ResultType 50057 is indeed the correct code for a disabled account. Option B is incorrect because grouping by both UserPrincipalName and IPAddress is necessary to detect multiple failed attempts from the same IP. Option D is incorrect because the threshold of 5 is likely reasonable; the issue is the time window, not the threshold.

Answer

The ResultType value 50057 is incorrect; it should be 50058 for disabled account

Answer

The query should group by UserPrincipalName only, not by IPAddress

Answer

The threshold of 5 is too high; reducing it would show results

Question 13

A threat hunter writes the KQL query above in Microsoft Defender for Endpoint advanced hunting to find devices where a script host process was launched with encoded commands and then connected to an HTTPS endpoint within 10 minutes. The query is syntactically correct but returns no results. The hunter knows that such activity has occurred. What is the most likely reason?

Accepted Answer

The join on Timestamp with exact match is too restrictive; should use a time window between the two events. The join condition uses an exact match on Timestamp, which requires both events to occur at the exact same second. This is unrealistic for two separate process and network events. The correct approach is to use a time window, e.g., 'between(DeviceEvents.Timestamp, DeviceNetworkEvents.Timestamp, -10m, 10m)', to allow events within 10 minutes of each other. Therefore, Option A is the most likely reason for no results.

Answer

The FileName list does not include other script hosts like 'mshta.exe'

Answer

The time range of 7 days is too short; should be 30 days

Answer

The RemotePort filter should include 80 for HTTP connections

Question 14

A threat hunter in Microsoft Sentinel is reviewing a JSON definition for a scheduled analytics rule as shown in the exhibit. The rule is intended to run daily and alert on any device running powershell.exe with an encoded command. However, no alerts have been generated even though the hunter knows such activity exists. What is the most likely cause?

Accepted Answer

The requiredDataConnectors lists MicrosoftThreatProtection, but the actual data may not be ingested if the connector is not configured. The rule specifies `requiredDataConnectors` as `MicrosoftThreatProtection`, which corresponds to Microsoft Defender for Endpoint. The query uses `DeviceProcessEvents`, a table from this connector. If the connector is not configured or data is not flowing, the table will have no data, resulting in zero alerts regardless of actual activity. Option B is incorrect because a `triggerThreshold` of 0 means any result triggers an alert, which is correct. Option C is incorrect because a `queryFrequency` of 1 day is appropriate for daily runs and does not cause missed events. Option D is incorrect because the `queryPeriod` of 14 days is sufficient to capture past events; it does not prevent alerts.

Answer

The triggerThreshold is set to 0, which should trigger on any result

Answer

The queryFrequency is 1 day, which may miss events if they occur right after the query runs

Answer

The queryPeriod is 14 days, which may be too short

Question 15

During a threat hunt, you discover that a PowerShell script executed on multiple servers and established outbound connections to an external IP address. Which data source should you query in Microsoft Defender XDR to identify the specific command-line arguments used?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents captures process creation events including command-line arguments. Option A (DeviceEvents) captures various events but not specifically process command lines. Option B (DeviceImageLoadEvents) captures DLL loads, not command lines. Option D (DeviceNetworkEvents) captures network connections but not command-line arguments.

Answer

DeviceEvents

Answer

DeviceImageLoadEvents

Answer

DeviceNetworkEvents

Question 16

Your threat hunt aims to detect possible Kerberoasting attacks. Which KQL query in Microsoft Sentinel would best identify service principal name (SPN) requests from unusual accounts?

Accepted Answer

let knownAccounts = dynamic(['svc_sql', 'svc_adfs']); SecurityEvent | where EventID == 4768 | where Account !in (knownAccounts) | summarize cnt=count() by Account, IpAddress | where cnt > 5. The best query for detecting Kerberoasting is Option C. Kerberoasting involves requesting Kerberos service tickets (TGS) for service principal names (SPNs) to crack the service account password. Event ID 4769 corresponds to a Kerberos service ticket request. Option C filters out known service accounts (like svc_sql, svc_adfs) and looks for accounts with more than 5 requests, which may indicate an attacker brute-forcing service tickets. Option A uses Event ID 4768 (TGT requests), which is not directly related to service ticket requests. Option B does not filter known accounts and includes all accounts. Option D uses Event ID 4773 (Kerberos service ticket renewal), which is not the typical event for Kerberoasting.

Answer

SecurityEvent | where EventID == 4768 | summarize count() by Account | where count_ > 10

Answer

SecurityEvent | where EventID == 4769 | summarize count() by Account

Answer

SecurityEvent | where EventID == 4773 | summarize count() by Account

Question 17

You are threat hunting for signs of credential dumping via LSASS access. Which Advanced Hunting schema table in Microsoft Defender XDR should you primarily query to find processes that opened a handle to LSASS?

Accepted Answer

DeviceEvents. (DeviceEvents) is correct because it includes events related to handle access, such as 'LsassAccessedByProcess' from the Microsoft Defender for Identity sensor. Option A (DeviceProcessEvents) records process creation events, not handle operations. Option C (DeviceNetworkEvents) captures network-related events. Option D (DeviceRegistryEvents) logs registry modifications, none of which cover LSASS handle access.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 18

Your threat hunt involves correlating alerts from Microsoft Defender for Cloud Apps with Microsoft Defender for Endpoint. Which Microsoft Sentinel integration should you use to unify these alerts for hunting?

Accepted Answer

Microsoft Sentinel's unified analytics rules and incident creation. Microsoft Sentinel provides built-in connectors and analytics rules to correlate alerts across Microsoft Defender XDR, including Defender for Cloud Apps and Defender for Endpoint. Option B (Power Automate) can automate workflows but does not provide a unified hunting experience or correlation. Option C (Microsoft Graph API) is programmatic and can retrieve alerts, but it is not a unified correlation tool. Option D (Azure Monitor Workbooks) visualizes data but does not correlate or unify alerts for hunting.

Answer

Power Automate flows to merge alerts

Answer

Microsoft Graph API to pull alerts into a custom database

Answer

Azure Monitor Workbooks to display alerts side by side

Question 19

During a hunt, you find that a user account has logged in from an IP address associated with a known command-and-control (C2) server. The hunt also reveals that the same IP accessed a SharePoint site containing sensitive documents. Which Microsoft Purview feature should you use to investigate data exfiltration?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct feature because it can monitor and detect when sensitive data is accessed or shared externally, such as when a user account from a C2 IP accesses a SharePoint site with sensitive documents. DLP policies can trigger alerts and provide detailed activity reports via the Activity Explorer, allowing security analysts to investigate potential data exfiltration. Option B (Information Protection) focuses on classifying and labeling sensitive data but does not track access or exfiltration events. Option C (Compliance Manager) is used for risk assessments and compliance posture, not for investigating specific incidents. Option D (Audit (Standard)) logs user activities but lacks the sensitivity context of DLP to identify exfiltration of sensitive data.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Audit (Standard)

Question 20

You need to create a custom detection rule in Microsoft Sentinel that alerts when an anomalous number of failed logons occur from a single IP address within 5 minutes. Which KQL operator should you use to count failed logons per IP?

Accepted Answer

summarize. 'summarize' is used to aggregate counts per key (IP). Option B (project) only selects columns. Option C (where) filters rows. Option D (extend) adds calculated columns.

Answer

project

Answer

where

Answer

extend