SC-200 Perform threat hunting Practice Test 11 — 15 Questions

Question 1

During a threat hunt, you discover a previously unknown malware variant that communicates over HTTPS to a command-and-control (C2) server. You want to create a custom detection in Microsoft Sentinel that triggers when any device in the organization resolves the C2 domain via DNS. Which data connector should you ensure is enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS (Preview) via AMA. (DNS (Preview) via AMA) is correct because the DNS data connector in Microsoft Sentinel ingests DNS query logs from DNS servers, which allows you to detect when devices resolve a specific domain (e.g., the C2 domain). Option B (Azure Activity) is incorrect because it logs Azure resource management activities, not DNS queries. Option C (Office 365) is incorrect because it ingests Office 365 audit logs, not DNS. Option D (Windows Security Events via AMA) is incorrect because it collects security events like logons and process creation, not DNS query logs.

Answer

Azure Activity

Answer

Office 365 (Preview)

Answer

Windows Security Events via AMA

Question 2

Your team uses Microsoft Defender for Endpoint to hunt for signs of credential theft. You want to query for events where a process accesses the LSASS process memory. Which event type should you look for?

Accepted Answer

Process access (Event 4656). Process access (Event 4656). LSASS memory access is detected by process access events, specifically Event ID 4656 which logs when a process opens a handle to another process. This event includes access flags that can indicate credential theft, such as PROCESS_VM_READ. Option B (Network connection) records network activities, not internal process access. Option C (Registry modification) tracks changes to the registry, not process memory access. Option D (Process creation) logs new process starts, but LSASS is already running; we need to detect access to its memory.

Answer

Network connection (Event 5156)

Answer

Registry modification (Event 4657)

Answer

Process creation (Event 4688)

Question 3

You are a threat hunter using Microsoft Sentinel. You have ingested syslog data from a Palo Alto firewall. You want to create a scheduled query rule that alerts when more than 10 outbound connections to a known bad IP address occur within 5 minutes. Which KQL function should you use to summarize the count?

Accepted Answer

summarize count() by SourceIp, DestinationIp. `summarize count() by SourceIp, DestinationIp` groups the data by the source and destination IP addresses and counts the number of occurrences in each group, which is exactly what we need to alert when more than 10 outbound connections to a known bad IP occur within 5 minutes. Option A is wrong because `project` selects columns without performing any aggregation; it merely filters the columns returned. Option B is wrong because `extend` adds a new column (here a constant 1) but does not count or group data. Option D is wrong because `join` merges two tables based on a key, not used for counting occurrences within a single table.

Answer

project SourceIp, DestinationIp

Answer

extend Count = 1

Answer

join kind=inner (Syslog)

Question 4

While threat hunting, you find a suspicious scheduled task that runs a PowerShell script from a temp directory. You want to check if this task exists on other devices in the environment. Which Microsoft Defender for Endpoint advanced hunting table would you query?

Accepted Answer

DeviceEvents. The `DeviceEvents` table includes scheduled task creation events (ActionType: ScheduledTaskCreated). Option A is wrong because `DeviceProcessEvents` focuses on process execution, not task creation. Option B is wrong because `DeviceNetworkEvents` is for network connections. Option D is wrong because `DeviceRegistryEvents` is for registry changes.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 5

Your organization uses Microsoft Defender for Office 365. You want to hunt for phishing emails that bypassed the initial filtering. Which feature should you use to manually submit suspicious emails for analysis and then review the results in the Threat Explorer?

Accepted Answer

Threat Explorer. The Threat Explorer in Microsoft Defender for Office 365 provides forensic analysis of email threats and allows manual submission of suspicious emails for review. Option A is wrong because the Attack Simulator is for running simulated phishing attacks, not for submitting or analyzing suspect emails. Option C is wrong because the Quarantine portal is for managing messages that were already quarantined by policy, not for submitting new samples. Option D is wrong because Email trace in the Exchange admin center focuses on message flow and delivery status, not on detailed threat investigation.

Answer

Attack Simulator

Answer

Quarantine portal

Answer

Email trace in Exchange admin center

Question 6

Which TWO of the following are valid data sources for Microsoft Sentinel threat hunting? (Choose 2)

Accepted Answer

Amazon Web Services CloudTrail. The correct answers are D (Amazon Web Services CloudTrail) and E (Azure Active Directory (Microsoft Entra ID)). Microsoft Sentinel provides native connectors for AWS CloudTrail via the AWS S3 connector and for Azure AD logs. Option A is incorrect because Syslog is a protocol, not a pre-built data source connector, though syslog data can be ingested via a custom mechanism. Option B is incorrect because Google Workspace is not natively supported as a connector in Microsoft Sentinel (requires custom integration). Option C is incorrect because ServiceNow is not a direct data source; it can be integrated via Logic Apps but not as a standard data connector.

Answer

Syslog

Answer

Google Workspace

Answer

ServiceNow

Question 7

Which THREE of the following are valid techniques for threat hunting using Microsoft Defender for Cloud Apps? (Choose 3)

Accepted Answer

Create custom activity policies to detect suspicious behaviors. Options A, B, and D are correct. Option A: you can create custom activity policies to detect anomalies. Option B: IP address ranges can be used to define trusted locations. Option D: User investigation allows examining user activities. Option C is wrong because custom detections in Microsoft Sentinel are not part of Defender for Cloud Apps. Option E is wrong because hunting queries are in Microsoft Defender for Endpoint, not Cloud Apps.

Answer

Create custom detections in Microsoft Sentinel

Answer

Use advanced hunting queries

Question 8

Which TWO of the following are recommended practices when performing threat hunting in Microsoft Sentinel? (Choose 2)

Accepted Answer

Create custom hunting queries based on hypothesis. When performing threat hunting in Microsoft Sentinel, it is recommended to create custom hunting queries based on a hypothesis (option A) and use watchlists to maintain high-value indicators for matching (option E). Relying solely on automated detection rules (option B) is insufficient because hunting involves proactive, hypothesis-driven analysis beyond automation. Disabling built-in analytics rules (option C) would remove valuable detection capabilities, and deleting log data older than 30 days (option D) would limit the historical data available for hunting. Therefore, the correct answers are A and E.

Answer

Rely solely on automated detection rules

Answer

Disable all built-in analytics rules to avoid noise

Answer

Delete log data older than 30 days to improve query performance

Question 9

You are reviewing a hunting query. What is the primary purpose of this query?

Accepted Answer

Find users with medium-risk sign-ins that share IP addresses with service principal sign-ins, indicating possible token theft or lateral movement. The query filters for users with medium risk sign-ins and joins with service principal sign-ins on IP address, then counts occurrences per user exceeding 5, indicating potential compromise involving both user and service principal activity from the same IP. Option A is wrong because it does not focus on service principal compromise alone. Option B is wrong because it does not look for admin consent grants. Option D is wrong because it uses only medium risk, not high.

Answer

List all users with any risk level during sign-in in the last 7 days

Answer

Detect users who have granted admin consent to malicious OAuth apps

Answer

Identify service principals that have been compromised and are performing high-risk sign-ins

Question 10

You are reviewing a Microsoft Sentinel scheduled analytics rule definition (JSON). What is the purpose of the "triggerThreshold": 0 setting?

Accepted Answer

The rule will generate an alert if the query returns at least one result. The triggerThreshold property in a Microsoft Sentinel scheduled analytics rule definition specifies the minimum number of query results required to trigger an alert. A value of 0 means the rule generates an alert if the query returns at least one result, as any positive result count exceeds 0. Option B correctly describes this behavior.

Answer

The rule will generate an alert only if the query returns exactly 1 result

Answer

The rule will not generate any alerts

Answer

The rule will generate an alert only if the query returns zero results

Question 11

You executed this Azure CLI command. What is the result?

Accepted Answer

A new hunting query is created in the Microsoft Sentinel workspace. The Azure CLI command creates a new hunting query named 'Suspicious PowerShell' in the specified Microsoft Sentinel workspace. Option B is wrong because the command does not immediately execute the query; it only saves it. Option C is wrong because the command creates a new query, not updates an existing one. Option D is wrong because the command creates a hunting query, not a scheduled analytics rule.

Answer

The hunting query is immediately executed and results are displayed

Answer

An existing hunting query is updated with new query text

Answer

A new scheduled analytics rule is created

Question 12

A security analyst is performing threat hunting in Microsoft Sentinel using KQL. The analyst wants to identify all network connections initiated from a specific internal IP address (10.0.0.5) to external IP addresses in the last 24 hours. Which KQL query should the analyst use?

Accepted Answer

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceIP == "10.0.0.5"
| where ipv4_is_private(DestinationIP) == false. It uses CommonSecurityLog, filters on the source IP (SourceIP) being the internal IP, and checks that the destination IP is not private (using ipv4_is_private(DestinationIP) == false). Option A uses DeviceNetworkEvents, which is not the standard table for network connections in Sentinel (CommonSecurityLog is more appropriate), and its private IP check is incorrect (only excludes 10.x.x.x but not other private ranges). Option C is wrong because it filters on DestinationIP instead of SourceIP, so it shows connections to that IP, not from it. Option D is wrong because it filters on only the last hour (ago(1h)), not the required 24 hours.

Answer

DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where LocalIP == "10.0.0.5"
| where RemoteIP !startswith "10."

Answer

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP == "10.0.0.5"
| where ipv4_is_private(DestinationIP) == false

Answer

CommonSecurityLog
| where TimeGenerated > ago(1h)
| where SourceIP == "10.0.0.5"
| where ipv4_is_private(DestinationIP) == false

Question 13

During a threat hunt, an analyst notices multiple failed logon events from a single user account across different workstations within a short time window. Which hunting technique is most appropriate to detect potential lateral movement?

Accepted Answer

Search for failed logon events (Event ID 4625) followed by successful logon (Event ID 4624) from the same account on different machines.. Failed logon events (Event ID 4625) followed by a successful logon (Event ID 4624) from the same account on different machines is a classic indicator of lateral movement. Attackers often test compromised credentials across multiple systems, and the pattern of initial failures followed by a success suggests credential stuffing or password spraying. Option A is incorrect: Event ID 4672 (special privileges assigned to new logon) is more associated with privilege escalation, not lateral movement. Option B is incorrect: while large outbound RDP connections from a single host could indicate lateral movement, the scenario describes a single user account failing across workstations, not a single host initiating connections. Option D is incorrect: creation of new user accounts (Event ID 4720) typically indicates persistence or backdoor creation, not lateral movement.

Answer

Search for multiple instances of special privileges assigned to new logon (Event ID 4672).

Answer

Search for large outbound RDP connections from a single host.

Answer

Search for creation of new user accounts (Event ID 4720).

Question 14

A threat hunter is using Microsoft Defender for Endpoint advanced hunting to find devices that have a specific file hash associated with a known malware variant. The analyst wants to include devices that have the file in any location, including quarantined items. Which table and column should be used?

Accepted Answer

DeviceFileEvents, SHA256. DeviceFileEvents tracks file creation, modification, and deletion events, including those that are quarantined, and it includes the SHA256 column for file hashes. Option A (DeviceImageLoadEvents) is for image (DLL) loads, not general file info. Option C (DeviceNetworkEvents) covers network connections, not files. Option D (DeviceProcessEvents) involves process execution, not file discovery, and its ProcessCommandLine column does not contain file hashes.

Answer

DeviceImageLoadEvents, SHA256

Answer

DeviceNetworkEvents, RemoteIP

Answer

DeviceProcessEvents, ProcessCommandLine

Question 15

A threat hunter wants to identify potential command and control (C2) communication by looking for DNS queries to domains with a high entropy and short TTL. Which advanced hunting query in Microsoft Defender XDR should be used?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents (Option A) includes DNS query events, making it suitable for detecting high-entropy DNS queries associated with C2 communication. AlertInfo contains security alerts, not raw DNS queries. IdentityLogonEvents tracks authentication events. EmailEvents tracks email-related events.

Answer

AlertInfo

Answer

IdentityLogonEvents

Answer

EmailEvents