SC-200 Perform threat hunting Practice Test 10 — 15 Questions

Question 1

Your team is using Microsoft 365 Defender advanced hunting to investigate a possible data exfiltration incident. The security team suspects that an internal attacker used a compromised SharePoint Online account to download sensitive files from multiple sites. You need to build a hunting query that identifies all file download activities from SharePoint Online for a specific user account over the past 7 days, and then calculates the total size of downloaded files. Which KQL query should you use?

Accepted Answer

CloudAppEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownloaded' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize). Option B correctly filters SharePoint file download events (FileDownloaded) and sums the FileSize. Option A uses wrong action; Option C uses wrong table; Option D is for email.

Answer

CloudAppEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownload' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize)

Answer

EmailEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownloaded' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize)

Answer

FileEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownloaded' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize)

Question 2

As a threat hunter at Contoso, you are investigating a potential advanced persistent threat (APT) that may have compromised multiple Azure subscriptions. You have Microsoft Defender for Cloud enabled and Microsoft Sentinel collecting data from all subscriptions. You suspect the attacker is using Azure Resource Manager operations to create malicious resources. You need to create a hunting query that identifies anomalous Azure management operations, specifically focusing on operations that create new resources (e.g., virtual machines, storage accounts) from unusual IP addresses or at unusual times. Which approach should you take?

Accepted Answer

Use the AzureActivity table to filter for operations where HttpMethod == 'PUT' (create/update), then summarize by CallerIpAddress and bin(TimeGenerated, 1h) to find spikes or unusual caller IPs.. Option C leverages the AzureActivity table with a filter for write operations (HTTP PUT) and summarizes by caller IP and operation time, allowing for anomaly detection. Option A is too broad; Option B focuses on sign-ins, not resource operations; Option D uses the wrong log source for Azure management events.

Answer

Use the CommonSecurityLog table to analyze network traffic from management tools.

Answer

Use the AzureActivity table in Microsoft Sentinel to query for any operation where the OperationNameValue contains 'write' and then manually review each result.

Answer

Query the SigninLogs table in Microsoft Sentinel for all interactive sign-ins to the Azure portal, then cross-reference with Azure Activity logs.

Question 3

Your organization uses Microsoft Defender for Identity (MDI) to monitor on-premises Active Directory. As a threat hunter, you receive an alert about a potential DCSync attack. You want to hunt for any other instances of this attack across your domain controllers over the past 30 days. Which hunting query should you run in Microsoft 365 Defender advanced hunting?

Accepted Answer

IdentityDirectoryEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'. Option C correctly uses the IdentityDirectoryEvents table to filter for DCSync attack type. Option A uses IdentityLogonEvents which is for logons, not directory replication; Option B uses IdentityQueryEvents but DCSync is a directory service attack, not a query; Option D uses the wrong table entirely.

Answer

DeviceEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Answer

IdentityLogonEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Answer

IdentityQueryEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Question 4

Your team is using Microsoft Sentinel to hunt for signs of Kerberos golden ticket attacks. You have enabled Advanced Security Audit Policy on domain controllers to log Kerberos service ticket operations (Event ID 4769). You need to create a KQL query that identifies potential golden ticket use by looking for service tickets that have anomalous attributes, such as ticket encryption type 0x17 (RC4) combined with a long lifetime or unusual service names. Which KQL query should you use?

Accepted Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == '0x17' and (TicketOptions contains '0x2' or ServiceName !startswith 'krbtgt'). Option A correctly filters for RC4 encryption type (0x17), a common indicator of forged tickets, and checks for long lifetime (TicketOptions contains '0x2' for renewable) and unusual services. Option B uses wrong encryption type; Option C only filters for encryption type without anomaly checks; Option D uses wrong event ID (4768 is for TGT requests).

Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == '0x17'

Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == '0x12' and TicketOptions contains '0x2'

Answer

SecurityEvent | where EventID == 4768 and TicketEncryptionType == '0x17'

Question 5

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector to ingest alerts and incidents from Defender for Endpoint, Defender for Office 365, and Defender for Identity. As a threat hunter, you want to proactively search for devices that may be communicating with known malicious IP addresses that have not yet triggered an alert. You have a list of known malicious IP addresses from an external threat intelligence feed. Which approach should you take to perform this hunt efficiently?

Accepted Answer

Create a Watchlist in Microsoft Sentinel containing the IP addresses, then write a KQL query in the Hunting blade that joins the Watchlist with DeviceNetworkEvents from Defender for Endpoint.. Option A is the most efficient: create a Watchlist in Sentinel with the IP list, then use KQL to join with DeviceNetworkEvents. Option B is inefficient for large lists; Option C uses the wrong connector; Option D is for automation, not hunting.

Answer

Create a Logic App that runs hourly and checks each IP against DeviceNetworkEvents, then creates incidents.

Answer

Use the ThreatIntelligenceIndicator table in Microsoft Sentinel, which automatically ingests the feed if you configure a Threat Intelligence - TAXII connector.

Answer

Manually add each IP address as a custom detection rule in Microsoft Sentinel for each device.

Question 6

A security analyst is performing threat hunting in Microsoft Sentinel and wants to identify anomalous outbound network connections from a compromised workstation. The analyst suspects that a beaconing pattern is present. Which KQL function is most appropriate to detect periodic beaconing behavior over time?

Accepted Answer

startofday(TimeGenerated). Option C is correct because the `startofday` function can be used to aggregate events by day and then count occurrences to detect regular beaconing. Option A is wrong because `make_list` is for creating arrays, not for time-series detection. Option B is wrong because `bin` can help but `startofday` is more natural for daily beaconing. Option D is wrong because `series_decompose` is for anomaly detection but not specifically for periodic beaconing.

Answer

series_decompose(TimeGenerated)

Answer

make_list(TimeGenerated)

Answer

bin(TimeGenerated, 1h)

Question 7

During a threat hunt, an analyst discovers that a user's device has been sending large amounts of data to an external IP address associated with a known C2 server. The analyst wants to trace the process responsible for the outbound connections. Which Microsoft Defender for Endpoint advanced hunting table should be queried to find the process that initiated the network connections?

Accepted Answer

DeviceNetworkEvents. Option B is correct because DeviceNetworkEvents contains network connection events including initiating process information. Option A is wrong because DeviceProcessEvents contains process creation events, not network connections. Option C is wrong because DeviceEvents contains various events but not network connections specifically. Option D is wrong because DeviceFileEvents contains file events.

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Answer

DeviceEvents

Question 8

A threat hunter wants to use Microsoft Sentinel to hunt for signs of brute-force attacks against Azure AD (now Microsoft Entra ID). Which data connector should be enabled to ingest sign-in logs?

Accepted Answer

Microsoft Entra ID. Option A is correct because Microsoft Entra ID connector (formerly Azure AD) provides sign-in logs. Option B is wrong because it provides audit logs, not sign-ins. Option C is for Windows security events, not cloud sign-ins. Option D is for DNS queries.

Answer

Windows Security Events via AMA

Answer

DNS (Preview)

Answer

Microsoft Entra ID Audit Logs

Question 9

A threat hunter is analyzing a suspicious email that bypassed Microsoft Defender for Office 365. The email contains a link to a malicious website. The hunter wants to identify all users who clicked the link. Which hunting query in Microsoft 365 Defender should be used?

Accepted Answer

EmailUrlInfo. Option C is correct because EmailUrlInfo contains URL clicks from email. Option A is wrong because it contains email events, not click data. Option B is wrong because it contains email attachment info. Option D is wrong because it contains file creation events.

Answer

EmailAttachmentInfo

Answer

EmailEvents

Answer

DeviceFileEvents

Question 10

During a threat hunt, a security analyst uses Microsoft Sentinel and identifies a series of failed logon attempts from a single IP address targeting multiple user accounts. The analyst wants to create a scheduled analytics rule that generates an alert when the same IP address fails to logon to more than 10 different accounts within 5 minutes. Which KQL operator should be used to count distinct accounts per IP?

Accepted Answer

dcount(Account). Option B is correct because dcount is an approximate distinct count that is efficient for large datasets. Option A is wrong because count counts all events, not distinct accounts. Option C is wrong because distinct is used to return unique rows, not to count. Option D is wrong because summarize with count() counts all rows.

Answer

count()

Answer

summarize count() by Account

Answer

distinct Account

Question 11

A threat hunter is investigating a potential data exfiltration incident. The hunter suspects that a user is using an unauthorized cloud storage service. Which Microsoft Defender for Cloud Apps signal would be most useful to detect this activity?

Accepted Answer

Cloud Discovery. Option A is correct because Defender for Cloud Apps can discover shadow IT cloud apps. Option B is wrong because it does not detect cloud app usage. Option C is wrong because it is for web filtering, not cloud apps. Option D is wrong because it is for email protection.

Answer

Microsoft Defender for Endpoint Web Protection

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365 Safe Links

Question 12

A threat hunter wants to use KQL in Microsoft Sentinel to find all events from the SecurityEvent table where the event ID is 4625 (failed logon) and the account name is not 'SYSTEM'. Which query achieves this?

Accepted Answer

SecurityEvent | where EventID == 4625 and Account != 'SYSTEM'. Option D is correct because it filters EventID and then excludes 'SYSTEM' account. Option A is wrong because it uses '!=' incorrectly. Option B is wrong because 'not' without parentheses may cause syntax error. Option C is wrong because 'equals' is not a KQL operator.

Answer

SecurityEvent | where EventID equals 4625 and Account not equals 'SYSTEM'

Answer

SecurityEvent | where EventID == 4625 and Account != 'SYSTEM'

Answer

SecurityEvent | where EventID == 4625 and not Account == 'SYSTEM'

Question 13

A threat hunter is using Microsoft Sentinel and wants to leverage machine learning to detect anomalous behavior in Azure subscription activity. Which analytics rule template should the hunter use?

Accepted Answer

Anomalous Azure Operations. Option B is correct because the Anomalous Azure Operations analytics rule uses ML to detect unusual Azure resource operations. Option A is wrong because it's for sign-ins. Option C is wrong because it's for user behavior. Option D is wrong because it's for on-premises lateral movement.

Answer

Anomalous Sign-In Locations

Answer

Anomalous User Behavior

Answer

Lateral Movement Detection

Question 14

A threat hunter wants to correlate alerts from multiple Microsoft security products in Microsoft Sentinel. Which feature should be used to create a unified incident?

Accepted Answer

Analytics Rules. Option D is correct because Incident creation rules (or analytics rules) can create incidents from alerts across products. Option A is wrong because it is for notebooks. Option B is wrong because it is for external threat intelligence. Option C is wrong because it is for investigation.

Answer

Threat Intelligence

Answer

Jupyter Notebooks

Answer

Investigation Graph

Question 15

Which TWO of the following are valid approaches to perform threat hunting using Microsoft Sentinel? (Choose two.)

Accepted Answer

Using the Hunting blade and Livestream. The Hunting blade in Microsoft Sentinel provides a dedicated interface for proactive threat hunting, allowing analysts to run KQL queries and pivot through results. Livestream extends this by enabling continuous, real-time query execution against incoming data, which is essential for detecting patterns that evolve over minutes or hours. Both features are explicitly designed for iterative, hypothesis-driven threat hunting rather than automated detection.

Answer

Using Fusion analytics rule

Answer

Using Automation rules to trigger playbooks

Answer

Using Azure Policy to enforce compliance