SC-200 Perform threat hunting Practice Test 12 — 15 Questions

Question 1

During a threat hunt, an analyst discovers a PowerShell script that was executed on multiple workstations with encoded commands. The analyst wants to find all instances of this script across the environment. Which hunting method in Microsoft Sentinel is most effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Search for the SHA256 hash of the script file in DeviceFileEvents.. Searching for the SHA256 hash of the script file in DeviceFileEvents will find every file with that hash across all workstations, regardless of location or execution context. Option B is incorrect because the encoded command string in DeviceProcessEvents may vary per execution (e.g., different encoding or parameters) and won't capture all instances. Option C is incorrect because DeviceNetworkEvents only records network downloads; the script could have been copied via USB or other means. Option D is incorrect because the script may not reside in the Temp folder; it could be in any directory.

Answer

Search for the encoded command string in DeviceProcessEvents command line.

Answer

Search for the script in DeviceNetworkEvents as a downloaded file.

Answer

Search for the script file name in DeviceFileEvents where the folder path contains 'Temp'.

Question 2

A threat hunter wants to investigate a potential data exfiltration event involving large outbound file transfers to an unusual external IP. Which Microsoft Defender XDR advanced hunting table is most appropriate to start the investigation?

Accepted Answer

DeviceFileEvents. (DeviceFileEvents) is correct because it captures file creation and modification events, which are directly relevant to detecting large outbound file transfers indicative of data exfiltration. Option A (DeviceNetworkEvents) shows network connections but lacks file-level details. Option B (DeviceProcessEvents) logs process creation events, not file transfers. Option C (IdentityDirectoryEvents) tracks identity activities, unrelated to file exfiltration.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

IdentityDirectoryEvents

Question 3

Which TWO actions are valid when performing threat hunting in Microsoft Sentinel using hunting queries? (Choose two.)

Accepted Answer

Bookmark specific rows of results for later investigation.. You can bookmark specific rows of hunting query results for later investigation. Option B is correct because you can create a custom detection rule (analytics rule) directly from a hunting query. Option C is incorrect because hunting queries cannot be scheduled; you would need to create an analytics rule to run automatically. Option D is incorrect because hunting queries are manual and do not automatically trigger alerts. Option E is incorrect because you cannot export results directly to Azure Blob Storage; results can be exported to CSV or stored in Log Analytics.

Answer

Schedule a hunting query to run every hour.

Answer

Automatically trigger an alert when a hunting query returns results.

Answer

Export results directly to Azure Blob Storage.

Question 4

Which THREE data sources can be used in Microsoft Sentinel for threat hunting to detect unusual authentication patterns? (Choose three.)

Accepted Answer

SecurityEvent (Windows Event Logs). Options A, B, and E are correct. Option A (SecurityEvent) contains Windows Event Logs with logon events (e.g., Event ID 4624), which are key for detecting unusual authentication patterns. Option B (AADNonInteractiveUserSignInLogs) captures non-interactive user sign-ins, crucial for spotting anomalous authentication in Microsoft Entra ID. Option E (SigninLogs) includes interactive sign-in logs from Microsoft Entra ID, providing detailed authentication data. Option C (CommonSecurityLog) is incorrect because it logs network security device events, not authentication. Option D (OfficeActivity) is incorrect as it records Office 365 service audit logs, not authentication events.

Answer

CommonSecurityLog

Answer

OfficeActivity (Office 365)

Question 5

Which TWO techniques are commonly used in threat hunting to identify potential malicious activity? (Choose two.)

Accepted Answer

Searching for known indicators of compromise (IoCs).. Searching for known indicators of compromise (IoCs) is a fundamental threat hunting technique, allowing hunters to identify known malicious activity. Option C is correct because analyzing anomalies in baseline behavior helps detect deviations that may indicate unknown threats, a core proactive hunting approach. Option B is wrong because disabling security controls is dangerous and not a legitimate hunting technique; threat hunting should not weaken defenses. Option D is wrong because waiting for automated alerts is reactive, not proactive hunting. Option E is wrong because automatically blocking suspicious traffic is an automated response, not a hunting technique; threat hunting involves human-led investigation.

Answer

Disabling security controls to observe attacker behavior.

Answer

Waiting for alerts from automated detection tools.

Answer

Automatically blocking all suspicious traffic.

Question 6

A threat hunter is investigating a potential compromise involving a user account that has been used to sign in from multiple locations within a short time. The hunter wants to use Microsoft Sentinel to find all sign-in events for that user from different IP addresses in the last 24 hours. Which KQL query should be used?

Accepted Answer

SigninLogs
| where TimeGenerated > ago(24h)
| where UserPrincipalName == "user@domain.com"
| summarize count() by IPAddress. SigninLogs contains user sign-in events and the query filters for the last 24 hours and the specific user, then summarizes by IP address. Option B is wrong because SecurityEvent is for Windows security events, not cloud sign-ins. Option C is wrong because AuditLogs contains administrative audit logs, not sign-in activity. Option D is wrong because CommonSecurityLog is for network security devices.

Answer

SecurityEvent
| where TimeGenerated > ago(24h)
| where TargetUserName == "user@domain.com"
| summarize count() by IpAddress

Answer

AuditLogs
| where TimeGenerated > ago(24h)
| where InitiatedBy.user.userPrincipalName == "user@domain.com"
| summarize count() by IPAddress

Answer

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceUserID == "user@domain.com"
| summarize count() by SourceIP

Question 7

A threat hunter is analyzing a potential advanced persistent threat (APT) that uses living-off-the-land binaries (LOLBins) like certutil.exe to download payloads. The hunter wants to find instances where certutil.exe was used to download files from the internet in the last week. Which KQL query in Microsoft Sentinel would be most effective?

Accepted Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "certutil.exe"
| where ProcessCommandLine contains "-urlcache" or ProcessCommandLine contains "-split"
| project Timestamp, DeviceName, ProcessCommandLine. It specifically filters for certutil.exe, a known LOLBin, and looks for '-urlcache' or '-split' arguments that indicate file downloads from the internet. Option A filters for powershell.exe with '-enc', which is for encoded commands, not downloads. Option B filters for mshta.exe with 'http', but mshta.exe can be used for other purposes. Option D filters for wscript.exe with 'http', which is not the primary LOLBin for downloads. Only C correctly targets certutil.exe download patterns.

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-enc"
| project Timestamp, DeviceName, ProcessCommandLine

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "mshta.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "wscript.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine

Question 8

Refer to the exhibit. You are analyzing a potential C2 communication pattern. The KQL query returns no results despite known malicious IPs being active. What is the most likely cause?

Accepted Answer

The devices generating the events are not onboarded to Microsoft Defender for Endpoint.. If the devices generating the network events are not onboarded to Microsoft Defender for Endpoint, they will not produce any DeviceNetworkEvents, resulting in no query results even when malicious IPs are active. Option A is incorrect because the query does not need a Direction filter to return results; it may include both inbound and outbound by default. Option C is incorrect because filtering on ActionType is not necessary to see the connection events; the absence of a filter does not cause empty results. Option D is incorrect because RemoteIP is the correct field for the destination IP address in DeviceNetworkEvents; replacing it with DestinationIpAddress would not fix the missing data issue.

Answer

The query is missing a filter for Direction equal to 'Outbound'.

Answer

The query does not include a filter for ActionType equal to 'ConnectionSuccess'.

Answer

The RemoteIP field should be replaced with DestinationIpAddress.

Question 9

Your security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to correlate Azure AD sign-in logs with Microsoft Defender for Cloud Apps alerts. Which KQL operator should they use to join the two tables on the user principal name?

Accepted Answer

join. The 'join' operator merges rows from two tables based on a matching key. Option A is incorrect because 'union' appends rows, not correlates. Option C is incorrect because 'lookup' is a type of join but is less common for this scenario. Option D is incorrect because 'evaluate' is used for plugin execution, not joining tables.

Answer

union

Answer

lookup

Answer

evaluate

Question 10

During a threat hunt, you discover a PowerShell script that downloads and executes a payload from a remote server. Which Microsoft Defender for Endpoint action type would most likely capture this behavior in DeviceEvents?

Accepted Answer

PowerShellCommand. PowerShell commands that download and execute scripts are typically logged as 'PowerShellCommand' in DeviceEvents. Option B (ProcessCreated) would show the PowerShell process creation but not the script content. Option C (FileCreated) would show the payload file but not the download execution. Option D (NetworkConnection) would show the connection but not the script execution.

Answer

ProcessCreated

Answer

FileCreated

Answer

NetworkConnection

Question 11

Refer to the exhibit. You are reviewing a custom scheduled analytics rule in Microsoft Sentinel. The rule is enabled but has not fired any alerts despite users having multiple locations in the last day. What is the most likely reason?

Accepted Answer

The 'Location' field does not exist in SigninLogs; the query returns an error silently.. The query references a 'Location' field, but the SigninLogs table does not contain a column named 'Location'. The actual column for location information is 'LocationDetails' or the location can be derived from IP address. Since the column does not exist, the query returns an empty result silently, causing no alerts. Option A is incorrect because UserPrincipalName is not case-sensitive in KQL. Option B is incorrect because the query frequency (1 hour) and query period (1 day) are valid settings; the mismatch is not the issue. Option C is incorrect because the rule is enabled as stated.

Answer

The UserPrincipalName field is case-sensitive and the data has mixed case.

Answer

The query frequency is set to 1 hour, but the query period is 1 day, causing a mismatch.

Answer

The rule is disabled.

Question 12

Your threat hunting team wants to identify all email messages that contained a specific malicious attachment hash in Microsoft 365. Which Microsoft Defender XRB data source should they query in Microsoft Sentinel?

Accepted Answer

EmailEvents. To identify email messages containing a specific malicious attachment hash in Microsoft 365, you should query the EmailEvents table in Microsoft Sentinel. EmailEvents captures detailed information about email messages, including attachment hashes. Option B, EmailAttachmentInfo, provides metadata about attachments but not the full email context. Option C, AlertEvidence, contains alert-related evidence, not raw email data. Option D, DeviceEvents, is for endpoint events and not relevant to email. Therefore, EmailEvents (Option A) is the correct table to query.

Answer

EmailAttachmentInfo

Answer

AlertEvidence

Answer

DeviceEvents

Question 13

While hunting for lateral movement, you want to find out which devices have established remote PowerShell sessions to other devices. Which Microsoft Defender for Endpoint advanced hunting table should you query?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents contains network connection data, including connections to remote management ports (5985/5986 for WinRM) used by remote PowerShell sessions. Option A is incorrect because DeviceProcessEvents shows process creation events, not network connections. Option B is incorrect because DeviceEvents shows general events, not specifically network connections. Option D is incorrect because DeviceLogonEvents shows logon events, not network sessions.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

DeviceLogonEvents

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During a threat hunt, you want to identify AWS resources that have been compromised by correlating AWS CloudTrail logs with Microsoft Defender for Cloud security alerts. How should you ingest AWS CloudTrail logs into Microsoft Sentinel?

Accepted Answer

Use the AWS S3 connector in Microsoft Sentinel.. AWS CloudTrail logs can be ingested into Microsoft Sentinel via the AWS S3 connector, which allows configuring an S3 bucket to stream CloudTrail logs into Sentinel. Option A is incorrect because Microsoft Defender for Cloud does not natively ingest CloudTrail logs; it provides security alerts but not log ingestion. Option C is incorrect because the Microsoft 365 Defender connector is for Microsoft 365 data, not AWS. Option D is incorrect because Azure Policy is used for governance, not for exporting logs.

Answer

Configure Microsoft Defender for Cloud to receive AWS CloudTrail logs.

Answer

Use the Microsoft 365 Defender connector to ingest CloudTrail logs.

Answer

Use Azure Policy to export CloudTrail logs to Log Analytics.

Question 15

You are hunting for privileged account abuse in Microsoft Entra ID. Which table in Microsoft Sentinel contains audit logs for changes to directory roles?

Accepted Answer

AuditLogs. AuditLogs in Microsoft Sentinel contain audit data from Microsoft Entra ID, including changes to directory roles. Option A (IdentityLogonEvents) is incorrect as it contains identity protection events. Option C (SigninLogs) is incorrect because it contains user sign-in events. Option D (DeviceLogonEvents) is incorrect as it logs device logon events.

Answer

IdentityLogonEvents

Answer

SigninLogs

Answer

DeviceLogonEvents