SC-200 Perform threat hunting Practice Test 10 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector to ingest alerts and incidents from Defender for Endpoint, Defender for Office 365, and Defender for Identity. As a threat hunter, you want to proactively search for devices that may be communicating with known malicious IP addresses that have not yet triggered an alert. You have a list of known malicious IP addresses from an external threat intelligence feed. Which approach should you take to perform this hunt efficiently?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Watchlist in Microsoft Sentinel containing the IP addresses, then write a KQL query in the Hunting blade that joins the Watchlist with DeviceNetworkEvents from Defender for Endpoint.. The most efficient approach. By creating a Watchlist in Microsoft Sentinel containing the list of known malicious IP addresses, you can write a KQL query in the Hunting blade that joins the Watchlist with the DeviceNetworkEvents table from Defender for Endpoint. This allows you to proactively query for any devices that have communicated with those IPs, even if no alert was generated. Option A is inefficient because Logic App is designed for automation and orchestration, not for ad-hoc hunting queries. Option C would require configuring a Threat Intelligence - TAXII connector with the specific feed, and the ThreatIntelligenceIndicator table may not contain the custom IP list. Option D is impractical for a large number of IPs and devices.

Answer

Create a Logic App that runs hourly and checks each IP against DeviceNetworkEvents, then creates incidents.

Answer

Use the ThreatIntelligenceIndicator table in Microsoft Sentinel, which automatically ingests the feed if you configure a Threat Intelligence - TAXII connector.

Answer

Manually add each IP address as a custom detection rule in Microsoft Sentinel for each device.

Question 2

A security analyst is performing threat hunting in Microsoft Sentinel and wants to identify anomalous outbound network connections from a compromised workstation. The analyst suspects that a beaconing pattern is present. Which KQL function is most appropriate to detect periodic beaconing behavior over time?

Accepted Answer

startofday(TimeGenerated). `startofday` groups timestamps by day, enabling analysts to count events per day and identify regular intervals characteristic of beaconing (e.g., daily connections). Option A is incorrect: `series_decompose` is used for time series decomposition (trend, seasonal, residual) but is not the most direct method for detecting periodic beaconing; it is more complex and typically used after aggregation. Option B is incorrect: `make_list` creates a list of values, not useful for periodicity detection. Option D is incorrect: `bin(TimeGenerated, 1h)` bins events into hourly buckets, which could detect beaconing at finer granularity, but daily beaconing is better suited to `startofday`; `bin` is not specifically for periodic pattern detection.

Answer

series_decompose(TimeGenerated)

Answer

make_list(TimeGenerated)

Answer

bin(TimeGenerated, 1h)

Question 3

During a threat hunt, an analyst discovers that a user's device has been sending large amounts of data to an external IP address associated with a known C2 server. The analyst wants to trace the process responsible for the outbound connections. Which Microsoft Defender for Endpoint advanced hunting table should be queried to find the process that initiated the network connections?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it captures network connection events, including the initiating process ID and name. This allows the analyst to identify which process established the outbound connection to the C2 server. DeviceProcessEvents only records process creation events, not network connections. DeviceEvents contains various system events but not detailed network connection data. DeviceFileEvents tracks file-related events such as creation and modification, not network connections.

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Answer

DeviceEvents

Question 4

A threat hunter wants to use Microsoft Sentinel to hunt for signs of brute-force attacks against Azure AD (now Microsoft Entra ID). Which data connector should be enabled to ingest sign-in logs?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) connector. This connector ingests sign-in logs, which contain authentication attempts and can be used to detect brute-force attacks. Option A (Windows Security Events via AMA) captures on-premises Windows security events, not cloud sign-ins. Option B (DNS Preview) ingests DNS query logs, not sign-in logs. Option C (Microsoft Entra ID Audit Logs) captures audit logs (e.g., user management, configuration changes), not authentication sign-in logs. Therefore, only Option D provides the necessary sign-in log data for hunting brute-force attacks.

Answer

Windows Security Events via AMA

Answer

DNS (Preview)

Answer

Microsoft Entra ID Audit Logs

Question 5

A threat hunter is analyzing a suspicious email that bypassed Microsoft Defender for Office 365. The email contains a link to a malicious website. The hunter wants to identify all users who clicked the link. Which hunting query in Microsoft 365 Defender should be used?

Accepted Answer

EmailUrlInfo. EmailUrlInfo. EmailUrlInfo tracks URLs that users clicked from email messages, including the user identity and URL details. This makes it the appropriate table to identify all users who clicked a malicious link. Option A (EmailAttachmentInfo) is incorrect because it contains information about email attachments, not URL clicks. Option C (EmailEvents) is incorrect because it covers email delivery events (e.g., send, receive, spam detection), not click actions. Option D (DeviceFileEvents) is incorrect because it tracks file creation and modification events on devices, unrelated to email URL clicks.

Answer

EmailAttachmentInfo

Answer

EmailEvents

Answer

DeviceFileEvents

Question 6

A threat hunter wants to use KQL in Microsoft Sentinel to find all events from the SecurityEvent table where the event ID is 4625 (failed logon) and the account name is not 'SYSTEM'. Which query achieves this?

Accepted Answer

SecurityEvent | where EventID == 4625 and Account != 'SYSTEM'. It uses the proper KQL syntax: '==' for equality and '!=' for inequality. Option A is incorrect because 'equals' is not a KQL operator; KQL uses '=='. Option C is syntactically identical to B but is considered a duplicate and not the intended correct answer. Option D uses 'not Account ==' which is not valid KQL; the correct syntax to exclude a value is 'Account != 'SYSTEM'.

Answer

SecurityEvent | where EventID equals 4625 and Account not equals 'SYSTEM'

Answer

SecurityEvent | where EventID == 4625 and Account != 'SYSTEM'

Answer

SecurityEvent | where EventID == 4625 and not Account == 'SYSTEM'

Question 7

A threat hunter is using Microsoft Sentinel and wants to leverage machine learning to detect anomalous behavior in Azure subscription activity. Which analytics rule template should the hunter use?

Accepted Answer

Anomalous Azure Operations. The Anomalous Azure Operations analytics rule uses ML to detect unusual Azure resource operations. Option A is wrong because it's for sign-ins. Option C is wrong because it's for user behavior. Option D is wrong because it's for on-premises lateral movement.

Answer

Anomalous Sign-In Locations

Answer

Anomalous User Behavior

Answer

Lateral Movement Detection

Question 8

A threat hunter wants to correlate alerts from multiple Microsoft security products in Microsoft Sentinel. Which feature should be used to create a unified incident?

Accepted Answer

Analytics Rules. Analytics Rules in Microsoft Sentinel can be configured to create incidents from alerts across multiple security products, enabling unified incident creation for threat hunting. Option A (Threat Intelligence) is used to import and use threat intelligence feeds, not to create incidents. Option B (Jupyter Notebooks) provides a platform for security analysis and automation using Python, not for incident creation. Option D (Investigation Graph) is a visual tool for exploring connections between entities in an investigation, not for creating incidents.

Answer

Threat Intelligence

Answer

Jupyter Notebooks

Answer

Investigation Graph

Question 9

Which TWO of the following are valid approaches to perform threat hunting using Microsoft Sentinel? (Choose two.)

Accepted Answer

Using the Hunting blade and Livestream. The Hunting blade in Microsoft Sentinel provides a dedicated interface for proactive threat hunting, allowing analysts to run KQL queries and pivot through results. Livestream extends this by enabling continuous, real-time query execution against incoming data, which is essential for detecting patterns that evolve over minutes or hours. Both features are explicitly designed for iterative, hypothesis-driven threat hunting rather than automated detection.

Answer

Using Fusion analytics rule

Answer

Using Automation rules to trigger playbooks

Answer

Using Azure Policy to enforce compliance

Question 10

Which THREE of the following are valid sources of data that a threat hunter can use in Microsoft Sentinel for hunting? (Choose three.)

Accepted Answer

Microsoft Entra ID audit logs. Options A, D, and E are correct because they represent data sources that can be ingested into Microsoft Sentinel for threat hunting. Microsoft Entra ID audit logs and Microsoft 365 audit logs are native Microsoft data sources. AWS CloudTrail logs can be connected via a connector. Options B (Azure Cost Management data) and C (Azure DevOps pipelines) are not standard data sources for threat hunting in Sentinel.

Answer

Azure Cost Management data

Answer

Azure DevOps pipelines

Question 11

Which TWO of the following are effective techniques for identifying lateral movement in Microsoft Defender for Endpoint advanced hunting? (Choose two.)

Accepted Answer

Search for remote desktop connections from non-administrative workstations. Remote desktop connections from non-administrative workstations can be a sign of lateral movement, as attackers often use RDP to move laterally. Option E is correct because NTLM authentication events can reveal pass-the-hash attacks, a common lateral movement technique. Option A is incorrect because successful logons from public IP addresses are more indicative of external intrusion or initial access, not lateral movement within the network. Option B is incorrect because large file uploads to cloud storage are typically associated with data exfiltration. Option D is incorrect because phishing emails are a method of initial access, not lateral movement.

Answer

Check for successful logons from public IP addresses

Answer

Look for large file uploads to cloud storage

Answer

Monitor for phishing emails

Question 12

During threat hunting, you identify a suspicious PowerShell process that executed encoded commands. Which Microsoft Defender XDR hunting capability would best help you trace the parent process and command-line arguments across the enterprise?

Accepted Answer

Advanced hunting. Advanced hunting in Microsoft Defender XDR uses KQL queries to trace parent processes and command-line arguments across devices, enabling detailed investigation of suspicious PowerShell activity. Option A is incorrect because automated investigation and response focuses on containment and remediation, not deep forensic tracing. Option B is incorrect because threat analytics provides threat intelligence and vulnerability information, not raw process event data. Option C is incorrect because device inventory shows device configurations and status, but lacks process lineage and command-line details.

Answer

Automated investigation and response

Answer

Threat analytics

Answer

Device inventory

Question 13

A threat hunter wants to proactively identify devices that may have been compromised by a known adversary using DLL side-loading techniques. Which Microsoft Sentinel solution or feature should the hunter leverage to create custom detection rules based on the latest threat intelligence?

Accepted Answer

Threat Intelligence integration with analytics rules. Microsoft Sentinel's Threat Intelligence integration allows importing threat intelligence indicators and creating analytics rules that can detect known adversary techniques like DLL side-loading. Option A is wrong because UEBA focuses on user entity behavior, not specific threat intelligence-based detections. Option B is wrong because automation rules with playbooks are for automated response, not for creating detection rules. Option C is wrong because custom workbooks are for visualization, not proactive detection.

Answer

User and Entity Behavior Analytics (UEBA)

Answer

Automation rules with playbooks

Answer

Custom workbooks

Question 14

Your threat hunting team uses Microsoft Sentinel. They want to search for anomalous network connections to known malicious IP addresses over the past 7 days. Which KQL operator should they use to match the source IP addresses against a watchlist containing the malicious IPs?

Accepted Answer

in. The `in` operator checks if a value exists in a list or dynamic array, which is exactly what is needed to match source IP addresses against a watchlist containing malicious IPs. Option A (`where`) is a clause used to filter rows, not an operator for list membership. Option C (`has`) is used for string containment, not exact match against a list. Option D (`contains`) is for substring matching, which is not suitable for IP address comparison.

Answer

where

Answer

has

Answer

contains

Question 15

You are threat hunting in Microsoft Defender for Cloud Apps. You want to identify users who have enabled mailbox forwarding rules to external domains, which could indicate data exfiltration. Which log source should you query?

Accepted Answer

Office 365 audit logs. Microsoft Defender for Cloud Apps can ingest Office 365 audit logs, which include Exchange mailbox audit events for forwarding rules. Options B, C, and D are incorrect: Microsoft Entra ID sign-in logs (B) do not contain mailbox forwarding events, Windows Event logs from domain controllers (C) are device-focused and do not include Exchange mailbox rules, and Azure Network Watcher logs (D) are for network monitoring and do not include mailbox rules.

Answer

Microsoft Entra ID sign-in logs

Answer

Windows Event logs from domain controllers

Answer

Azure Network Watcher logs