SC-200 Perform threat hunting — 50 Questions

Question 1

A security analyst is using KQL in Microsoft Sentinel to hunt for potential data exfiltration by a user who has been sending unusually large amounts of data to an external IP address. Which KQL operator should the analyst use to identify the top source IP addresses and total bytes sent over the last 7 days?

Accepted Answer

... | summarize TotalBytes=sum(SentBytes) by SourceIP | top 10 by TotalBytes desc. The summarize operator with sum() aggregation computes total bytes per source IP, and top 10 limits to the top results. Option A is correct. Option B (where) filters but does not aggregate. Option C (project) only selects columns. Option D (extend) adds computed columns without aggregation.

Answer

... | where SentBytes > 1000000 | project SourceIP, SentBytes

Answer

... | extend TotalBytes=SentBytes | summarize count() by SourceIP

Answer

... | project SourceIP, SentBytes | sort by SentBytes desc

Question 2

A threat hunter is using Microsoft Defender for Endpoint advanced hunting to investigate a suspicious process that was observed launching from a temporary folder. The hunter wants to find all devices that have executed this specific process (with the same SHA256 hash) in the last 24 hours. Which table and column should be used in the query?

Accepted Answer

DeviceProcessEvents table, SHA256 column. DeviceProcessEvents contains process execution events, and SHA256 stores the hash. Option C is correct. Option A (DeviceFileEvents) is for file creation/modification, not execution. Option B (DeviceNetworkEvents) is for network connections. Option D (DeviceEvents) is a generic table that may not include process hash.

Answer

DeviceNetworkEvents table, SHA256 column

Answer

DeviceEvents table, SHA256 column

Answer

DeviceFileEvents table, SHA256 column

Question 3

During a threat hunt in Microsoft Sentinel, an analyst creates a custom hunting query that uses the 'externaldata' operator to reference a CSV file stored in Azure Blob Storage. The hunt identifies several suspicious IP addresses that need to be added to a threat intelligence indicator. Which method should the analyst use to persist the findings as indicators of compromise (IOCs) for automated alerting?

Accepted Answer

Upload the CSV to a custom threat intelligence feed using the Threat Intelligence - Upload Indicators API. Option C is correct because Microsoft Sentinel can ingest threat intelligence from custom CSV files via a Threat Intelligence - Upload Indicators API or TAXII connector; the analyst can upload the CSV as a new threat intelligence feed. Option A (watchlist) is for temporary lookups, not persistent IOCs for detection. Option B (custom analytics rule) would require the rule to reference the data, but the IOCs are not stored as indicators. Option D (Azure Logic Apps) could automate but is not the primary method for persisting IOCs.

Answer

Add the IPs to a Microsoft Sentinel watchlist and reference the watchlist in an analytics rule

Answer

Create a custom analytics rule that includes the IPs as inline indicators

Answer

Use Azure Logic Apps to create a playbook that blocks the IPs automatically

Question 4

A security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to detect when a user account has been used to log in from an unusual location and then immediately performs a password reset for another user. Which hunting approach is most effective for this scenario?

Accepted Answer

Write a KQL query that joins SigninLogs with AuditLogs on user principal name and times within a short window. Option B (KQL query using join between two tables) is correct because it allows correlating login events from one table with password reset events from another table, combining the two conditions. Option A (single table) cannot correlate two different event types. Option C (watchlist) is for static data, not real-time correlation. Option D (playbook) is for automated response, not hunting.

Answer

Use a Microsoft Sentinel playbook to automatically flag any password reset

Answer

Search the SigninLogs table for logins from unusual locations

Answer

Create a watchlist of known unusual locations and use it in a query against AuditLogs

Question 5

A threat hunter is investigating a potential malware outbreak in Microsoft Defender for Cloud Apps. The hunter notices that multiple users have installed a new app with high permissions that accesses their email. The app was not requested by IT. What is the most effective way to hunt for all instances of this app across the organization?

Accepted Answer

Use the Cloud App Security activity log to search for 'Install app' events and then review the 'App governance' dashboard for all instances. Option D (use the Activity log to search for app installations and then investigate using App Governance or Cloud App Security) is correct because it first identifies the app via installations and then uses app analytics to scope all instances. Option A (conditional access policy) is reactive and not hunting. Option B (alerts) only catches known threats. Option C (OAuth apps page) can list apps but may not show all historical installations; activity log is more comprehensive for hunting.

Answer

Review Conditional Access app control policies for any block rules

Answer

Check Microsoft 365 Defender alerts for malicious OAuth apps

Answer

Query the Microsoft 365 Defender advanced hunting table 'CloudAppEvents' for app installation events and then use 'AppGovernance' to list all apps

Question 6

A threat hunter is using Microsoft Sentinel and Microsoft Defender XDR to hunt for a potential cross-domain attack where an attacker compromised an on-premises server and then used a privileged account to sign into Microsoft 365 from a new IP. The hunter wants to identify the server using a query that combines Windows Event Logs from the server with Microsoft 365 sign-in logs. Which approach should the hunter take to correlate the data?

Accepted Answer

Ingest Windows Security Event logs (Event ID 4624) from the server into a Log Analytics workspace, and join with SigninLogs on account name and timestamp. Option A is correct because the server's Security Event ID 4624 (account logon) can be used to identify the logon session, and then the account's IP can be correlated with Azure AD SigninLogs. Option B (DeviceLogonEvents) is for Microsoft Defender for Endpoint, not on-premises servers without MDE. Option C (Sysmon) requires additional configuration. Option D (Sentinel watchlist) is static and not suitable for dynamic correlation.

Answer

Create a Sentinel watchlist of known attacker IPs and compare with server logs

Answer

Enable Sysmon on the server and use its Event ID 3 (network connection) to find the IP

Answer

Use the DeviceLogonEvents table in Microsoft Defender XDR advanced hunting

Question 7

A threat hunter wants to proactively search for signs of ransomware activity in the environment using Microsoft Sentinel. Which data source is most likely to provide early indicators of ransomware, such as mass file renaming or encryption?

Accepted Answer

Microsoft Defender for Endpoint advanced hunting tables like DeviceFileEvents and DeviceProcessEvents. Option B (Microsoft Defender for Endpoint) provides advanced hunting on endpoint processes and file events, which can detect mass file modifications indicative of ransomware. Option A (Azure Activity Log) logs control plane operations. Option C (Office 365 audit logs) logs cloud app activities. Option D (Azure AD sign-in logs) logs authentication events.

Answer

Azure AD sign-in logs

Answer

Azure Activity Log

Answer

Office 365 audit logs (UnifiedAuditLog)

Question 8

During a threat hunt, an analyst discovers a PowerShell script that was executed on multiple servers in the environment. The script connects to an external IP address and downloads a payload. The analyst wants to find all other servers that may have been compromised by the same script. What is the most efficient way to search for this across the environment?

Accepted Answer

Use the DeviceProcessEvents table in Microsoft Defender for Endpoint advanced hunting to search for the script's SHA256 hash or command line pattern. Option C (search Microsoft Defender for Endpoint advanced hunting for the PowerShell script content hash or command line) is correct because it uses the known IOCs from the discovered script to find all occurrences. Option A (all servers' event logs) is inefficient and may miss modern logging. Option B (Sysmon) requires Sysmon to be installed. Option D (network logs from firewall) may not capture process details.

Answer

Use Sysmon Event ID 1 (process creation) to find PowerShell executions

Answer

Review the network logs from the firewall for connections to the external IP

Answer

Query the Windows Event Log for Event ID 4104 (PowerShell script block logging) on each server

Question 9

A threat hunter is using Microsoft Sentinel to hunt for a potential advanced persistent threat (APT) that is using living-off-the-land binaries (LOLBins). The hunter creates a KQL query that lists all instances of certutil.exe making network connections. The query returns many legitimate results. What is the best way to reduce false positives while still detecting malicious use?

Accepted Answer

Add additional filters to the query to detect only certutil.exe processes with suspicious command-line arguments (e.g., '-urlcache' or '-split'). Option A (add conditions for unusual command-line arguments) is correct because malicious use of LOLBins often involves specific arguments (e.g., -urlcache, -split). Option B (ignore certutil.exe) would miss threats. Option C (switch to Sysmon) adds overhead but does not reduce false positives on its own. Option D (expand to all LOLBins) increases noise.

Answer

Replace the query with a Sysmon Event ID 3 (network connect) filter for certutil.exe

Answer

Remove certutil.exe from the hunting query and focus on other binaries

Answer

Expand the query to include all LOLBins that make network connections

Question 10

A threat hunter is using Microsoft Sentinel to hunt for signs of privilege escalation via Azure AD role assignment changes. Which TWO KQL operators or functions are most useful for identifying changes that added a user to a high-privilege role?

Accepted Answer

summarize. Option A (where) filters for specific operations like 'Add member to role'. Option C (summarize) can count changes per user or role. Option B (project) only selects columns. Option D (mvexpand) expands multi-valued fields. Option E (evaluate) is for plugin operators.

Answer

project

Answer

evaluate

Answer

mvexpand

Question 11

A threat hunter is investigating a potential data exfiltration via DNS tunneling using Microsoft Defender for Endpoint advanced hunting. Which THREE columns from the DeviceNetworkEvents table should the hunter include in a query to detect anomalous DNS queries?

Accepted Answer

RemoteUrl. Option A (RemoteIP) is the destination IP of the DNS server; not the queried domain. Option B (RemoteUrl) contains the domain name being queried. Option C (InitiatingProcessFileName) shows which process made the query. Option D (Timestamp) is essential for time patterns. Option E (ActionType) indicates if it's a DNS query. Correct: RemoteUrl, InitiatingProcessFileName, Timestamp. ActionType is not a column in DeviceNetworkEvents for DNS; it's in DeviceEvents.

Answer

ActionType

Answer

RemoteIP

Question 12

A security analyst is using Microsoft Sentinel to hunt for signs of a brute-force attack against Azure AD. Which TWO data sources are most relevant for this hunt?

Accepted Answer

SigninLogs. Option A (SigninLogs) contains successful and failed sign-in attempts. Option B (AuditLogs) logs administrative actions, not sign-ins. Option C (AADNonInteractiveUserSignInLogs) includes non-interactive sign-ins, which may also be targeted. Option D (AzureActivity) logs resource operations. Option E (OfficeActivity) logs SharePoint/Exchange activities.

Answer

AzureActivity

Answer

OfficeActivity

Answer

AuditLogs

Question 13

A threat hunter runs the KQL query above in Microsoft Sentinel to detect accounts that have experienced multiple failed sign-in attempts due to a disabled account (ResultType 50057) from the same IP. The query returns no results even though the hunter knows that some disabled accounts are being attacked. What is the most likely reason for the false negatives?

Accepted Answer

The time range (1h) is too narrow; the attacks may be spread over several hours. Option B is correct because the query only looks at the last 1 hour; if attacks occurred over a longer period, they would be missed. Option A (ResultType wrong) is possible but not the most likely since 50057 is correct. Option C (summarize over UserPrincipalName alone) would group by user, but the query already includes IPAddress. Option D (threshold too high) could be, but the scenario says attacks are happening; time window is the most likely cause.

Answer

The ResultType value 50057 is incorrect; it should be 50058 for disabled account

Answer

The query should group by UserPrincipalName only, not by IPAddress

Answer

The threshold of 5 is too high; reducing it would show results

Question 14

A threat hunter writes the KQL query above in Microsoft Defender for Endpoint advanced hunting to find devices where a script host process was launched with encoded commands and then connected to an HTTPS endpoint within 10 minutes. The query is syntactically correct but returns no results. The hunter knows that such activity has occurred. What is the most likely reason?

Accepted Answer

The join on Timestamp with exact match is too restrictive; should use a time window between the two events. Option D is correct because the join condition uses Timestamp which is not precise enough; the join should use a time window, not an exact match. The where clause after join tries to use Timestamp1 (not defined) and also compares incorrectly. Option A (time range too short) is possible but less likely given 7 days. Option B (filename list) is broad enough. Option C (RemotePort 443) is expected for HTTPS.

Answer

The FileName list does not include other script hosts like 'mshta.exe'

Answer

The time range of 7 days is too short; should be 30 days

Answer

The RemotePort filter should include 80 for HTTP connections

Question 15

A threat hunter in Microsoft Sentinel is reviewing a JSON definition for a scheduled analytics rule as shown in the exhibit. The rule is intended to run daily and alert on any device running powershell.exe with an encoded command. However, no alerts have been generated even though the hunter knows such activity exists. What is the most likely cause?

Accepted Answer

The requiredDataConnectors lists MicrosoftThreatProtection, but the actual data may not be ingested if the connector is not configured. Option D is correct because the query uses the table DeviceProcessEvents, which is part of Microsoft Defender for Endpoint (MicrosoftThreatProtection connector), but the data connector specified is MicrosoftThreatProtection; if the connector is not connected or data is not flowing, no results. Option A (queryPeriod) affects how far back the query looks, but if data is present, it should still find some. Option B (triggerThreshold 0) is correct for alerting on any result. Option C (queryFrequency) is daily, which is fine.

Answer

The triggerThreshold is set to 0, which should trigger on any result

Answer

The queryFrequency is 1 day, which may miss events if they occur right after the query runs

Answer

The queryPeriod is 14 days, which may be too short

Question 16

During a threat hunt, you discover that a PowerShell script executed on multiple servers and established outbound connections to an external IP address. Which data source should you query in Microsoft Defender XDR to identify the specific command-line arguments used?

Accepted Answer

DeviceProcessEvents. Option C is correct because DeviceProcessEvents captures process creation events including command-line arguments. Option A (DeviceNetworkEvents) captures network connections but not command-line arguments. Option B (DeviceEvents) captures various events but not specifically process command lines. Option D (DeviceImageLoadEvents) captures DLL loads, not command lines.

Answer

DeviceEvents

Answer

DeviceImageLoadEvents

Answer

DeviceNetworkEvents

Question 17

Your threat hunt aims to detect possible Kerberoasting attacks. Which KQL query in Microsoft Sentinel would best identify service principal name (SPN) requests from unusual accounts?

Accepted Answer

let knownAccounts = dynamic(['svc_sql', 'svc_adfs']); SecurityEvent | where EventID == 4768 | where Account !in (knownAccounts) | summarize cnt=count() by Account, IpAddress | where cnt > 5. Option B is correct because it joins TGT requests (Kerberos TGS requests) with high count per account and filters out known service accounts. Option A misses the join with known accounts. Option C focuses on TGT renewal, not service tickets. Option D uses a different event ID (4769 is for TGS, not TGT).

Answer

SecurityEvent | where EventID == 4768 | summarize count() by Account | where count_ > 10

Answer

SecurityEvent | where EventID == 4769 | summarize count() by Account

Answer

SecurityEvent | where EventID == 4773 | summarize count() by Account

Question 18

You are threat hunting for signs of credential dumping via LSASS access. Which Advanced Hunting schema table in Microsoft Defender XDR should you primarily query to find processes that opened a handle to LSASS?

Accepted Answer

DeviceEvents. Option D is correct because DeviceEvents includes events like 'LsassAccessedByProcess' from the Microsoft Defender for Identity sensor. Option A (DeviceProcessEvents) records process creation, not handle open. Option B (DeviceNetworkEvents) is for network. Option C (DeviceRegistryEvents) is for registry.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 19

Your threat hunt involves correlating alerts from Microsoft Defender for Cloud Apps with Microsoft Defender for Endpoint. Which Microsoft Sentinel integration should you use to unify these alerts for hunting?

Accepted Answer

Microsoft Sentinel's unified analytics rules and incident creation. Option A is correct because Microsoft Sentinel provides built-in connectors and analytics rules to correlate alerts across Microsoft Defender XDR, including Defender for Cloud Apps and Defender for Endpoint. Option B (Microsoft Graph API) is programmatic but not a unified hunting experience. Option C (Azure Monitor Workbooks) visualizes but does not correlate. Option D (Power Automate) automates responses but not correlation.

Answer

Power Automate flows to merge alerts

Answer

Microsoft Graph API to pull alerts into a custom database

Answer

Azure Monitor Workbooks to display alerts side by side

Question 20

During a hunt, you find that a user account has logged in from an IP address associated with a known command-and-control (C2) server. The hunt also reveals that the same IP accessed a SharePoint site containing sensitive documents. Which Microsoft Purview feature should you use to investigate data exfiltration?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Option B is correct because Microsoft Purview Data Loss Prevention (DLP) policies and activity explorer can show if sensitive data was accessed or shared externally. Option A (Information Protection) labels data but does not track exfiltration. Option C (Audit Log) logs events but lacks context of sensitive data. Option D (Compliance Manager) is for assessments, not investigation.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Audit (Standard)