SC-200 Perform threat hunting — 25 Questions

Question 1

A threat hunter is using Microsoft Defender for Endpoint advanced hunting to investigate a suspicious process that was observed launching from a temporary folder. The hunter wants to find all devices that have executed this specific process (with the same SHA256 hash) in the last 24 hours. Which table and column should be used in the query?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeviceProcessEvents table, SHA256 column. DeviceProcessEvents table tracks process execution events and includes the SHA256 column for the file hash. Therefore, Option C is correct. Option A (DeviceNetworkEvents) is for network connections and does not include SHA256. Option B (DeviceEvents) is a generic table that may not include process hash. Option D (DeviceFileEvents) is for file creation/modification, not execution.

Answer

DeviceNetworkEvents table, SHA256 column

Answer

DeviceEvents table, SHA256 column

Answer

DeviceFileEvents table, SHA256 column

Question 2

During a threat hunt in Microsoft Sentinel, an analyst creates a custom hunting query that uses the 'externaldata' operator to reference a CSV file stored in Azure Blob Storage. The hunt identifies several suspicious IP addresses that need to be added to a threat intelligence indicator. Which method should the analyst use to persist the findings as indicators of compromise (IOCs) for automated alerting?

Accepted Answer

Upload the CSV to a custom threat intelligence feed using the Threat Intelligence - Upload Indicators API. Microsoft Sentinel can ingest threat intelligence from custom CSV files via the Threat Intelligence - Upload Indicators API, allowing the analyst to persist the suspicious IPs as indicators of compromise (IOCs) for automated alerting. Option B (watchlist) is for temporary lookups, not persistent IOCs for detection. Option C (custom analytics rule with inline indicators) does not store the IPs as reusable threat intelligence indicators. Option D (Azure Logic Apps) could automate actions but is not the primary method for persisting IOCs.

Answer

Add the IPs to a Microsoft Sentinel watchlist and reference the watchlist in an analytics rule

Answer

Create a custom analytics rule that includes the IPs as inline indicators

Answer

Use Azure Logic Apps to create a playbook that blocks the IPs automatically

Question 3

A threat hunter is using Microsoft Sentinel and Microsoft Defender XDR to hunt for a potential cross-domain attack where an attacker compromised an on-premises server and then used a privileged account to sign into Microsoft 365 from a new IP. The hunter wants to identify the server using a query that combines Windows Event Logs from the server with Microsoft 365 sign-in logs. Which approach should the hunter take to correlate the data?

Accepted Answer

Ingest Windows Security Event logs (Event ID 4624) from the server into a Log Analytics workspace, and join with SigninLogs on account name and timestamp. It directly correlates the on-premises server's Windows Security Event logs (Event ID 4624, which records successful logons with account name and source IP) with Microsoft 365 SigninLogs (Azure AD sign-ins) in a Log Analytics workspace. This allows the hunter to join on the account name and approximate timestamp to identify which server was used to launch the cloud sign-in from a new IP. Option A is wrong because a watchlist of known attacker IPs is static and cannot dynamically correlate server logs with cloud sign-ins. Option B (Sysmon Event ID 3) captures network connections, not logon events, so it won't directly identify the privileged account used. Option D (DeviceLogonEvents) only applies to devices enrolled in Microsoft Defender for Endpoint, not to on-premises servers without MDE, and it doesn't include Microsoft 365 sign-in logs.

Answer

Create a Sentinel watchlist of known attacker IPs and compare with server logs

Answer

Enable Sysmon on the server and use its Event ID 3 (network connection) to find the IP

Answer

Use the DeviceLogonEvents table in Microsoft Defender XDR advanced hunting

Question 4

A threat hunter wants to proactively search for signs of ransomware activity in the environment using Microsoft Sentinel. Which data source is most likely to provide early indicators of ransomware, such as mass file renaming or encryption?

Accepted Answer

Microsoft Defender for Endpoint advanced hunting tables like DeviceFileEvents and DeviceProcessEvents. (Microsoft Defender for Endpoint) provides advanced hunting on endpoint processes and file events, which can detect mass file modifications indicative of ransomware. Option A (Azure AD sign-in logs) logs authentication events. Option C (Azure Activity Log) logs control plane operations. Option D (Office 365 audit logs) logs cloud app activities.

Answer

Azure AD sign-in logs

Answer

Azure Activity Log

Answer

Office 365 audit logs (UnifiedAuditLog)

Question 5

During a threat hunt, an analyst discovers a PowerShell script that was executed on multiple servers in the environment. The script connects to an external IP address and downloads a payload. The analyst wants to find all other servers that may have been compromised by the same script. What is the most efficient way to search for this across the environment?

Accepted Answer

Use the DeviceProcessEvents table in Microsoft Defender for Endpoint advanced hunting to search for the script's SHA256 hash or command line pattern. It leverages Microsoft Defender for Endpoint's advanced hunting to centrally search for the script's SHA256 hash or command line pattern across all endpoints. Option A is incorrect because Sysmon may not be installed on all servers, and querying each server individually is inefficient. Option B is incorrect because network logs only show network connections and do not provide process execution details. Option D is incorrect because querying Event ID 4104 requires enabling PowerShell script block logging and accessing each server individually, which is less efficient than centralized hunting.

Answer

Use Sysmon Event ID 1 (process creation) to find PowerShell executions

Answer

Review the network logs from the firewall for connections to the external IP

Answer

Query the Windows Event Log for Event ID 4104 (PowerShell script block logging) on each server

Question 6

A threat hunter is using Microsoft Sentinel to hunt for signs of privilege escalation via Azure AD role assignment changes. Which TWO KQL operators or functions are most useful for identifying changes that added a user to a high-privilege role?

Accepted Answer

summarize. The correct answers are D: summarize and E: where. The 'where' operator filters for specific operations like 'Add member to role', which is essential to identify privilege escalation. The 'summarize' operator can count changes per user or role, allowing the analyst to see which users or roles have been modified. Option A (project) only selects columns and does not help with identification. Option B (evaluate) is used for plugin operators and is not relevant here. Option C (mvexpand) expands multi-valued fields, which is not directly useful for this purpose.

Answer

project

Answer

evaluate

Answer

mvexpand

Question 7

A threat hunter is investigating a potential data exfiltration via DNS tunneling using Microsoft Defender for Endpoint advanced hunting. Which THREE columns from the DeviceNetworkEvents table should the hunter include in a query to detect anomalous DNS queries?

Accepted Answer

RemoteUrl. RemoteUrl contains the fully qualified domain name being queried, which is crucial for identifying unusual DNS requests. Timestamp allows analysis of temporal patterns often associated with tunneling. InitiatingProcessFileName identifies the process that generated the query, helping distinguish legitimate from malicious activity. ActionType is not a column in DeviceNetworkEvents (it exists in DeviceEvents). RemoteIP is the destination IP of the DNS server, not the queried domain, and is less relevant for detecting tunneling.

Answer

ActionType

Answer

RemoteIP

Question 8

A security analyst is using Microsoft Sentinel to hunt for signs of a brute-force attack against Azure AD. Which TWO data sources are most relevant for this hunt?

Accepted Answer

SigninLogs. (SigninLogs) contains successful and failed sign-in attempts for interactive user sign-ins. Option E (AADNonInteractiveUserSignInLogs) includes non-interactive sign-ins, which may also be targeted by brute-force attacks. Option A (AzureActivity) logs resource operations, not sign-ins. Option C (OfficeActivity) logs SharePoint and Exchange activities, not sign-ins. Option D (AuditLogs) logs administrative actions, not sign-ins.

Answer

AzureActivity

Answer

OfficeActivity

Answer

AuditLogs

Question 9

A threat hunter runs the KQL query above in Microsoft Sentinel to detect accounts that have experienced multiple failed sign-in attempts due to a disabled account (ResultType 50057) from the same IP. The query returns no results even though the hunter knows that some disabled accounts are being attacked. What is the most likely reason for the false negatives?

Accepted Answer

The time range (1h) is too narrow; the attacks may be spread over several hours. The query uses a time range of only the last hour. If the failed sign-in attempts are spread over a longer period, they will not all be captured within that narrow window, leading to false negatives. Option A is incorrect because ResultType 50057 is indeed the correct code for a disabled account. Option B is incorrect because grouping by both UserPrincipalName and IPAddress is necessary to detect multiple failed attempts from the same IP. Option D is incorrect because the threshold of 5 is likely reasonable; the issue is the time window, not the threshold.

Answer

The ResultType value 50057 is incorrect; it should be 50058 for disabled account

Answer

The query should group by UserPrincipalName only, not by IPAddress

Answer

The threshold of 5 is too high; reducing it would show results

Question 10

A threat hunter writes the KQL query above in Microsoft Defender for Endpoint advanced hunting to find devices where a script host process was launched with encoded commands and then connected to an HTTPS endpoint within 10 minutes. The query is syntactically correct but returns no results. The hunter knows that such activity has occurred. What is the most likely reason?

Accepted Answer

The join on Timestamp with exact match is too restrictive; should use a time window between the two events. The join condition uses an exact match on Timestamp, which requires both events to occur at the exact same second. This is unrealistic for two separate process and network events. The correct approach is to use a time window, e.g., 'between(DeviceEvents.Timestamp, DeviceNetworkEvents.Timestamp, -10m, 10m)', to allow events within 10 minutes of each other. Therefore, Option A is the most likely reason for no results.

Answer

The FileName list does not include other script hosts like 'mshta.exe'

Answer

The time range of 7 days is too short; should be 30 days

Answer

The RemotePort filter should include 80 for HTTP connections

Question 11

A threat hunter in Microsoft Sentinel is reviewing a JSON definition for a scheduled analytics rule as shown in the exhibit. The rule is intended to run daily and alert on any device running powershell.exe with an encoded command. However, no alerts have been generated even though the hunter knows such activity exists. What is the most likely cause?

Accepted Answer

The requiredDataConnectors lists MicrosoftThreatProtection, but the actual data may not be ingested if the connector is not configured. The rule specifies `requiredDataConnectors` as `MicrosoftThreatProtection`, which corresponds to Microsoft Defender for Endpoint. The query uses `DeviceProcessEvents`, a table from this connector. If the connector is not configured or data is not flowing, the table will have no data, resulting in zero alerts regardless of actual activity. Option B is incorrect because a `triggerThreshold` of 0 means any result triggers an alert, which is correct. Option C is incorrect because a `queryFrequency` of 1 day is appropriate for daily runs and does not cause missed events. Option D is incorrect because the `queryPeriod` of 14 days is sufficient to capture past events; it does not prevent alerts.

Answer

The triggerThreshold is set to 0, which should trigger on any result

Answer

The queryFrequency is 1 day, which may miss events if they occur right after the query runs

Answer

The queryPeriod is 14 days, which may be too short

Question 12

During a threat hunt, you discover that a PowerShell script executed on multiple servers and established outbound connections to an external IP address. Which data source should you query in Microsoft Defender XDR to identify the specific command-line arguments used?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents captures process creation events including command-line arguments. Option A (DeviceEvents) captures various events but not specifically process command lines. Option B (DeviceImageLoadEvents) captures DLL loads, not command lines. Option D (DeviceNetworkEvents) captures network connections but not command-line arguments.

Answer

DeviceEvents

Answer

DeviceImageLoadEvents

Answer

DeviceNetworkEvents

Question 13

Your threat hunt involves correlating alerts from Microsoft Defender for Cloud Apps with Microsoft Defender for Endpoint. Which Microsoft Sentinel integration should you use to unify these alerts for hunting?

Accepted Answer

Microsoft Sentinel's unified analytics rules and incident creation. Microsoft Sentinel provides built-in connectors and analytics rules to correlate alerts across Microsoft Defender XDR, including Defender for Cloud Apps and Defender for Endpoint. Option B (Power Automate) can automate workflows but does not provide a unified hunting experience or correlation. Option C (Microsoft Graph API) is programmatic and can retrieve alerts, but it is not a unified correlation tool. Option D (Azure Monitor Workbooks) visualizes data but does not correlate or unify alerts for hunting.

Answer

Power Automate flows to merge alerts

Answer

Microsoft Graph API to pull alerts into a custom database

Answer

Azure Monitor Workbooks to display alerts side by side

Question 14

You need to create a custom detection rule in Microsoft Sentinel that alerts when an anomalous number of failed logons occur from a single IP address within 5 minutes. Which KQL operator should you use to count failed logons per IP?

Accepted Answer

summarize. 'summarize' is used to aggregate counts per key (IP). Option B (project) only selects columns. Option C (where) filters rows. Option D (extend) adds calculated columns.

Answer

project

Answer

where

Answer

extend

Question 15

You are investigating a potential DCSync attack. Which Advanced Hunting query in Microsoft Defender XDR would best detect a process making atypical directory replication requests?

Accepted Answer

DeviceEvents | where ActionType == 'DirectoryReplicationRequest'. DeviceEvents captures 'DirectoryReplicationRequest' events from Microsoft Defender for Identity, which are indicative of DCSync attacks. Option A (IdentityDirectoryEvents) captures directory changes but not replication requests. Option B (DeviceProcessEvents) captures process creation, not replication requests. Option C (IdentityLogonEvents) captures logon events, not replication.

Answer

IdentityDirectoryEvents | where ActionType == 'Replication'

Answer

DeviceProcessEvents | where FileName contains 'ntdsutil'

Answer

IdentityLogonEvents | where ActionType == 'DirectoryReplication'

Question 16

You are hunting for signs of pass-the-hash (PtH) attacks. Which Windows Security Event ID should you focus on to detect anomalous NTLM authentication using a hash?

Accepted Answer

4624 (Logon) with LogonType 3. Event ID 4624 (Logon) with LogonType 3 (network) is the correct event to detect pass-the-hash because PtH involves network logons using NTLM hashes. Event ID 4672 (Special Logon) indicates assignment of special privileges but is not directly related to PtH. Event ID 4648 (Explicit Credential) is used when credentials are passed explicitly, not indicative of hash reuse. Event ID 4776 (Credential Validation) records attempts to validate credentials but does not specify the logon type or protocol used, making it less specific for PtH. Therefore, D is correct.

Answer

4672 (Special Logon)

Answer

4648 (Explicit Credential)

Answer

4776 (Credential Validation)

Question 17

A security analyst is using Microsoft Sentinel to hunt for signs of Kerberos golden ticket attacks. Which KQL function is most appropriate to identify anomalous Kerberos service ticket requests?

Accepted Answer

find. The KQL function find() searches across multiple tables, which is useful for hunting in different logs to identify anomalous Kerberos service ticket requests. Option B (evaluate) is for invoking plugins, not for searching across tables. Option C (search) is deprecated in favor of find(). Option D (union) combines rows from multiple tables but does not search for specific patterns or values.

Answer

evaluate

Answer

search

Answer

union

Question 18

A threat hunter wants to use Microsoft Sentinel's UEBA to identify anomalous behavior. Which data connector must be enabled to provide the necessary Azure Active Directory (now Microsoft Entra ID) sign-in logs for UEBA?

Accepted Answer

Microsoft Entra ID. UEBA in Microsoft Sentinel requires sign-in logs to detect anomalous behavior. The Microsoft Entra ID connector (option C) provides these sign-in logs from Azure AD/Entra ID. Option A (Office 365) provides Exchange, Teams, and SharePoint logs, but not sign-in logs. Option B (Microsoft Entra ID Audit) provides only audit logs, not sign-in events. Option D (Windows Security Events via AMA) provides security event logs from Windows machines, which do not contain cloud sign-in data. Therefore, the Microsoft Entra ID connector is the correct choice.

Answer

Office 365

Answer

Microsoft Entra ID Audit

Answer

Windows Security Events via AMA

Question 19

A threat hunter suspects a data exfiltration attempt via DNS tunneling. Which KQL query would best detect unusual DNS query patterns in Microsoft Sentinel?

Accepted Answer

DnsEvents | summarize count() by ClientIP, Subdomain | where count_ > 100. To detect DNS tunneling, you need to look for a high volume of queries to many unique subdomains from a single client, which indicates potential data exfiltration. Option A uses `summarize count() by ClientIP, Subdomain` and filters where the count is greater than 100, directly identifying clients with a large number of queries to different subdomains—a classic sign of DNS tunneling. Option B filters on response size > 1000, which may indicate large payloads but is not the primary indicator of tunneling. Option C filters on non-zero result codes, which may indicate failures but not specifically tunneling. Option D filters on query type 'A', which is too broad and does not isolate tunneling patterns.

Answer

DnsEvents | where ResponseSize > 1000

Answer

DnsEvents | where ResultCode != 0

Answer

DnsEvents | where QueryType == 'A'

Question 20

Which THREE indicators are commonly associated with ransomware activity in Microsoft Sentinel threat hunting?

Accepted Answer

Network connections to known C2 infrastructure. Ransomware activity commonly involves three indicators: network connections to known C2 infrastructure (command and control communication), mass file rename or extension changes (file encryption), and scheduled task creation on multiple endpoints (persistence mechanism). Option A (unusual DNS queries to known safe domains) is not typical for ransomware, and option C (excessive failed logon attempts) is more indicative of brute-force attacks. Therefore, the correct options are A, D, and E.

Answer

Unusual DNS queries to known safe domains

Answer

Excessive failed logon attempts from a single IP