SC-200 Perform threat hunting — 50 Questions

Question 1

During a threat hunt in Microsoft Sentinel, an analyst creates a custom hunting query that uses the 'externaldata' operator to reference a CSV file stored in Azure Blob Storage. The hunt identifies several suspicious IP addresses that need to be added to a threat intelligence indicator. Which method should the analyst use to persist the findings as indicators of compromise (IOCs) for automated alerting?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Upload the CSV to a custom threat intelligence feed using the Threat Intelligence - Upload Indicators API. The Threat Intelligence - Upload Indicators API is the correct method to persist findings as IOCs in Microsoft Sentinel. This API allows you to upload indicators directly to the threat intelligence data store, where they can be used by analytics rules and automation for alerting and response. It is designed for programmatic ingestion of IOCs and integrates with Sentinel's threat intelligence features.

Answer

Add the IPs to a Microsoft Sentinel watchlist and reference the watchlist in an analytics rule

Answer

Create a custom analytics rule that includes the IPs as inline indicators

Answer

Use Azure Logic Apps to create a playbook that blocks the IPs automatically

Question 2

A threat hunter is using Microsoft Sentinel to hunt for signs of privilege escalation via Azure AD role assignment changes. Which TWO KQL operators or functions are most useful for identifying changes that added a user to a high-privilege role?

Accepted Answer

summarize. Option D (summarize) is correct because it lets the hunter aggregate Microsoft Entra ID audit events by fields such as the target user, role name, or operation, so they can count or group role-assignment changes and surface suspicious additions to high-privilege roles. Option E (where) is correct because it filters the audit log rows to only those matching the relevant operation, such as 'Add member to role', and to high-privilege role names, isolating the privilege-escalation events of interest. The other options do not belong: project only selects or renames columns and does not identify changes, evaluate runs a subquery or plugin over data rather than filtering role assignments, and mvexpand expands arrays into rows but does not by itself detect or aggregate role-assignment changes.

Answer

project

Answer

evaluate

Answer

mvexpand

Question 3

A threat hunter is investigating a potential data exfiltration via DNS tunneling using Microsoft Defender for Endpoint advanced hunting. Which THREE columns from the DeviceNetworkEvents table should the hunter include in a query to detect anomalous DNS queries?

Accepted Answer

RemoteUrl. Incorrect for this specific hunting goal. ActionType is a real column in DeviceNetworkEvents (it exists and can be used to filter to DNS-related connection events), but it is not one of the three most useful columns for spotting anomalous DNS tunneling queries — the queried domain (RemoteUrl), timing pattern (Timestamp), and the originating process (InitiatingProcessFileName) are more directly diagnostic of tunneling behavior such as high query volume or unusually long/encoded subdomains.

Answer

ActionType

Answer

RemoteIP

Question 4

A security analyst is using Microsoft Sentinel to hunt for signs of a brute-force attack against Azure AD. Which TWO data sources are most relevant for this hunt?

Accepted Answer

SigninLogs. SigninLogs (B) is correct because it captures interactive Microsoft Entra ID sign-in events, including failed sign-in attempts, error codes such as 50126 (invalid credentials), and source IP addresses, which are the primary evidence of a brute-force attack against user accounts. AADNonInteractiveUserSignInLogs (E) is correct because it records non-interactive sign-ins (e.g., token refresh, client credential flows), which attackers may also hammer with repeated authentication attempts and which are essential to correlate with interactive failures for a complete brute-force picture. AzureActivity (A) only logs Azure Resource Manager control-plane operations, not authentication events, so it would not show failed sign-ins. OfficeActivity (C) covers Microsoft 365 workload audit events like SharePoint, Exchange, and Teams activities, not Microsoft Entra ID authentication failures. AuditLogs (D) records Microsoft Entra ID directory changes such as user, group, and role modifications, not sign-in attempts, so it is not relevant to detecting brute-force authentication activity.

Answer

AzureActivity

Answer

OfficeActivity

Answer

AuditLogs

Question 5

A threat hunter runs the KQL query above in Microsoft Sentinel to detect accounts that have experienced multiple failed sign-in attempts due to a disabled account (ResultType 50057) from the same IP. The query returns no results even though the hunter knows that some disabled accounts are being attacked. What is the most likely reason for the false negatives?

Accepted Answer

The time range (1h) is too narrow; the attacks may be spread over several hours. The query uses a time range of only the last hour. If the failed sign-in attempts are spread over a longer period, they will not all be captured within that narrow window, leading to false negatives. Option A is incorrect because ResultType 50057 is indeed the correct code for a disabled account. Option B is incorrect because grouping by both UserPrincipalName and IPAddress is necessary to detect multiple failed attempts from the same IP. Option D is incorrect because the threshold of 5 is likely reasonable; the issue is the time window, not the threshold.

Answer

The ResultType value 50057 is incorrect; it should be 50058 for disabled account

Answer

The query should group by UserPrincipalName only, not by IPAddress

Answer

The threshold of 5 is too high; reducing it would show results

Question 6

A threat hunter writes the KQL query above in Microsoft Defender for Endpoint advanced hunting to find devices where a script host process was launched with encoded commands and then connected to an HTTPS endpoint within 10 minutes. The query is syntactically correct but returns no results. The hunter knows that such activity has occurred. What is the most likely reason?

Accepted Answer

The join on Timestamp with exact match is too restrictive; should use a time window between the two events. The join condition uses an exact match on Timestamp, which requires both events to occur at the exact same second. This is unrealistic for two separate process and network events. The correct approach is to use a time window, e.g., 'between(DeviceEvents.Timestamp, DeviceNetworkEvents.Timestamp, -10m, 10m)', to allow events within 10 minutes of each other. Therefore, Option A is the most likely reason for no results.

Answer

The FileName list does not include other script hosts like 'mshta.exe'

Answer

The time range of 7 days is too short; should be 30 days

Answer

The RemotePort filter should include 80 for HTTP connections

Question 7

A threat hunter in Microsoft Sentinel is reviewing a JSON definition for a scheduled analytics rule as shown in the exhibit. The rule is intended to run daily and alert on any device running powershell.exe with an encoded command. However, no alerts have been generated even though the hunter knows such activity exists. What is the most likely cause?

Accepted Answer

The requiredDataConnectors lists MicrosoftThreatProtection, but the actual data may not be ingested if the connector is not configured. The most likely cause is that the requiredDataConnectors field lists MicrosoftThreatProtection, but the actual data may not be ingested if the connector is not configured. In Microsoft Sentinel, analytics rules depend on the specified data connectors to ingest the necessary logs; if the connector is not properly configured or enabled, the rule will not receive any data to query, resulting in no alerts even if the activity exists.

Answer

The triggerThreshold is set to 0, which should trigger on any result

Answer

The queryFrequency is 1 day, which may miss events if they occur right after the query runs

Answer

The queryPeriod is 14 days, which may be too short

Question 8

Your threat hunt aims to detect possible Kerberoasting attacks. Which KQL query in Microsoft Sentinel would best identify service principal name (SPN) requests from unusual accounts?

Accepted Answer

SecurityEvent | where EventID == 4769 | summarize count() by Account. The best query for detecting Kerberoasting is Option C. Kerberoasting involves requesting Kerberos service tickets (TGS) for service principal names (SPNs) to crack the service account password. Event ID 4769 corresponds to a Kerberos service ticket request. Option C filters out known service accounts (like svc_sql, svc_adfs) and looks for accounts with more than 5 requests, which may indicate an attacker brute-forcing service tickets. Option A uses Event ID 4768 (TGT requests), which is not directly related to service ticket requests. Option B does not filter known accounts and includes all accounts. Option D uses Event ID 4773 (Kerberos service ticket renewal), which is not the typical event for Kerberoasting.

Answer

SecurityEvent | where EventID == 4768 | summarize count() by Account | where count_ > 10

Answer

let knownAccounts = dynamic(['svc_sql', 'svc_adfs']); SecurityEvent | where EventID == 4768 | where Account !in (knownAccounts) | summarize cnt=count() by Account, IpAddress | where cnt > 5

Answer

SecurityEvent | where EventID == 4773 | summarize count() by Account

Question 9

During a hunt, you find that a user account has logged in from an IP address associated with a known command-and-control (C2) server. The hunt also reveals that the same IP accessed a SharePoint site containing sensitive documents. Which Microsoft Purview feature should you use to investigate data exfiltration?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the feature designed to detect and prevent exfiltration of sensitive information across endpoints, Exchange, SharePoint, OneDrive, and Teams. Since the hunt shows sensitive SharePoint documents being accessed from a C2-associated IP, DLP policies and alerts are the right tool to investigate and contain the data-exfiltration activity.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Audit (Standard)

Question 10

Your threat hunt identifies that an attacker used a previously unknown malware variant to move laterally. Which Microsoft Defender XDR feature would you use to automatically block the file based on behavioral detection?

Accepted Answer

Attack Surface Reduction (ASR) rules. Attack Surface Reduction (ASR) rules in Microsoft Defender XDR are designed to block behaviors commonly used by malware, even if the specific file is unknown. ASR rules target actions like executable content from email, obfuscated scripts, and process creation from Office macros, which are typical lateral movement techniques. Since the malware variant is previously unknown, signature-based methods like custom file indicators (IoCs) would not work, but ASR rules can block based on behavior. Thus, ASR rules provide automatic blocking based on behavioral detection.

Answer

Web Protection

Answer

Custom file indicators (IoC)

Answer

Network Protection

Question 11

You are investigating a potential DCSync attack. Which Advanced Hunting query in Microsoft Defender XDR would best detect a process making atypical directory replication requests?

Accepted Answer

DeviceEvents | where ActionType == 'DirectoryReplicationRequest'. DCSync attacks are detected in Microsoft Defender XDR by monitoring for directory replication requests originating from non-domain-controller processes. The DeviceEvents table with ActionType 'DirectoryReplicationRequest' captures these anomalous replication attempts, which is the signature of a DCSync attack using tools like Mimikatz's lsadump::dcsync.

Answer

IdentityDirectoryEvents | where ActionType == 'Replication'

Answer

DeviceProcessEvents | where FileName contains 'ntdsutil'

Answer

IdentityLogonEvents | where ActionType == 'DirectoryReplication'

Question 12

You are hunting for signs of pass-the-hash (PtH) attacks. Which Windows Security Event ID should you focus on to detect anomalous NTLM authentication using a hash?

Accepted Answer

4624 (Logon) with LogonType 3. B) Event ID 4648 (Explicit Credential) logs when credentials are explicitly supplied, which could be part of a PtH attack, but it is not the primary event to focus on. C) Event ID 4776 (Credential Validation) logs credential validation attempts on a domain controller, but it is not specific to pass-the-hash attacks.

Answer

4672 (Special Logon)

Answer

4648 (Explicit Credential)

Answer

4776 (Credential Validation)

Question 13

A security analyst is using Microsoft Sentinel to hunt for signs of Kerberos golden ticket attacks. Which KQL function is most appropriate to identify anomalous Kerberos service ticket requests?

Accepted Answer

search. The KQL function find() searches across multiple tables, which is useful for hunting in different logs to identify anomalous Kerberos service ticket requests. Option B (evaluate) is for invoking plugins, not for searching across tables. Option C (search) is deprecated in favor of find(). Option D (union) combines rows from multiple tables but does not search for specific patterns or values.

Answer

find

Answer

evaluate

Answer

union

Question 14

During a hunt, you find a device that made successive outbound connections to multiple IP addresses on port 445 (SMB) within a short time. Which type of activity does this pattern most likely indicate?

Accepted Answer

Lateral movement preparation. Successive outbound connections to multiple IP addresses on port 445 (SMB) within a short time is a classic pattern of lateral movement preparation, where an attacker scans for open SMB shares or attempts to spread across the network. This activity often precedes actual lateral movement, such as using exploits like EternalBlue.

Answer

Data exfiltration

Answer

Command and control beaconing

Answer

Internal reconnaissance

Question 15

You are hunting for signs of Pass-the-Hash attacks using Microsoft Defender for Identity. Which alert should you look for in Microsoft Defender XDR?

Accepted Answer

Suspected overpass-the-hash attack. Pass-the-Hash attacks in Microsoft Defender for Identity are surfaced via the 'Suspected overpass-the-hash attack' alert, which detects attempts to use a hash to obtain a Kerberos ticket. This alert specifically flags the overpass-the-hash technique where an NTLM hash is used to request a TGT, a common lateral movement method.

Answer

Honeytoken activity

Answer

Privilege escalation

Answer

Suspected brute force attack

Question 16

A threat hunter suspects a data exfiltration attempt via DNS tunneling. Which KQL query would best detect unusual DNS query patterns in Microsoft Sentinel?

Accepted Answer

DnsEvents | summarize count() by ClientIP, Subdomain | where count_ > 100. To detect DNS tunneling, you need to look for a high volume of queries to many unique subdomains from a single client, which indicates potential data exfiltration. Option A uses `summarize count() by ClientIP, Subdomain` and filters where the count is greater than 100, directly identifying clients with a large number of queries to different subdomains—a classic sign of DNS tunneling. Option B filters on response size > 1000, which may indicate large payloads but is not the primary indicator of tunneling. Option C filters on non-zero result codes, which may indicate failures but not specifically tunneling. Option D filters on query type 'A', which is too broad and does not isolate tunneling patterns.

Answer

DnsEvents | where ResponseSize > 1000

Answer

DnsEvents | where ResultCode != 0

Answer

DnsEvents | where QueryType == 'A'

Question 17

Which TWO Microsoft Sentinel hunting features can be used to automatically surface suspicious activities without manual query writing?

Accepted Answer

Livestream. Livestream (C) is correct because it lets you run a saved hunting query continuously and raises an incident/alert when new matching events appear, so suspicious activity is surfaced automatically without writing new queries each time. Hunting queries (E) are correct because Microsoft Sentinel ships built-in, pre-written hunting queries that can be run (and scheduled) to proactively surface suspicious activity without the analyst authoring KQL from scratch. Workbooks (A) are only dashboards/visualization reports and do not detect or surface suspicious activity on their own. Analytics rules (B) do automate alerting, but they are the scheduled detection/incident-creation mechanism rather than a hunting feature, and the question asks specifically about hunting features. Playbooks (D) are SOAR automation workflows triggered by incidents/alerts, not a hunting capability for surfacing suspicious activity.

Answer

Workbooks

Answer

Analytics rules

Answer

Playbooks

Question 18

You are reviewing a hunting query that identifies accounts with failed logons followed by successful logons from the same IP. The query returns no results even though you suspect brute force activity. What is the most likely issue?

Accepted Answer

The join condition is too strict; the SourceIP might differ between failed and successful logons. The most likely issue is that the join condition is too strict — specifically, the query requires the SourceIP to match exactly between failed and successful logons. In real brute-force or password-spray activity, the attacker often rotates source IPs (via proxies, VPNs, or botnets), so the successful logon may come from a different IP than the failed attempts. Relaxing the join (e.g., joining on account only, or using a time-window correlation) would surface the activity.

Answer

The time range is too short

Answer

The threshold is too low

Answer

The EventID for successful logon is incorrect

Question 19

You are creating a custom hunting query in Microsoft Sentinel for PowerShell Empire indicators. After deploying, the query never returns results, even though you know empire activity exists in the environment. What is the most likely cause?

Accepted Answer

The query logic is flawed; it should group the conditions with parentheses. The query combines 'FileName contains 'powershell'' with 'ProcessCommandLine contains 'System.Net.WebClient'' and 'InitiatingProcessFileName contains 'powershell'' using OR and AND without parentheses. In KQL, AND has higher precedence than OR. Therefore, the query is evaluated as: (FileName contains 'powershell') OR (ProcessCommandLine contains '...' AND InitiatingProcessFileName contains '...'). This likely returns results that are not PowerShell Empire activity. To correctly identify PowerShell processes using WebClient, the conditions should be grouped: (FileName contains 'powershell' OR InitiatingProcessFileName contains 'powershell') AND ProcessCommandLine contains '...'. Option C is correct because the logic flaw is the missing parentheses. Option A (using 'and' instead of 'or') would make the query too restrictive. Option B (connector) is irrelevant; the query would work with the existing connector. Option D (changing 'contains' to 'startswith') would miss cases where the string appears mid-text.

Answer

The query should use 'and' instead of 'or'

Answer

The required data connector should be 'MicrosoftThreatProtection'

Answer

The 'contains' operator should be 'startswith'

Question 20

A threat hunter runs this KQL query to find devices making many outbound SMB connections. The result shows a device 'DC01' connecting to over 100 different IPs on port 445. What is the most likely explanation?

Accepted Answer

DC01 is performing normal domain operations like Group Policy distribution. A domain controller (DC01) making many outbound SMB connections to unique IPs is typical for normal activity such as Group Policy distribution and logon scripts. Option D correctly identifies this as normal domain operations. Option A (data exfiltration) is unlikely because SMB is not commonly used for exfiltration. Option B (network scanning) is possible but less likely for a DC under normal circumstances. Option C (malware spreading) is a concern but not the most probable explanation given the DC's role.

Answer

DC01 is exfiltrating data via SMB

Answer

DC01 is scanning the network for open SMB shares

Answer

DC01 is compromised and spreading malware