SC-200 Perform threat hunting Practice Test 12 — 15 Questions

Question 1

You are reviewing a Microsoft Sentinel scheduled analytics rule definition (JSON). What is the purpose of the "triggerThreshold": 0 setting?

Accepted Answer

The rule will generate an alert if the query returns at least one result. Option A is correct because a trigger threshold of 0 means the rule will generate an alert even if no results are returned (i.e., 0 results trigger), which is unusual but possible for certain use cases. Option B is wrong because threshold of 0 does not match count of 1. Option C is wrong because it's not about count of 1. Option D is wrong because threshold of 0 means no alert only if threshold is -1 or not set.

Answer

The rule will generate an alert only if the query returns exactly 1 result

Answer

The rule will not generate any alerts

Answer

The rule will generate an alert only if the query returns zero results

Question 2

You executed this Azure CLI command. What is the result?

Accepted Answer

A new hunting query is created in the Microsoft Sentinel workspace. Option B is correct because the command creates a new hunting query named 'Suspicious PowerShell' in the specified Microsoft Sentinel workspace. Option A is wrong because it does not run the query immediately. Option C is wrong because it does not create an analytics rule. Option D is wrong because it does not modify an existing query.

Answer

The hunting query is immediately executed and results are displayed

Answer

An existing hunting query is updated with new query text

Answer

A new scheduled analytics rule is created

Question 3

A security analyst is performing threat hunting in Microsoft Sentinel using KQL. The analyst wants to identify all network connections initiated from a specific internal IP address (10.0.0.5) to external IP addresses in the last 24 hours. Which KQL query should the analyst use?

Accepted Answer

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceIP == "10.0.0.5"
| where ipv4_is_private(DestinationIP) == false. Option C is correct because it filters on the source IP and only includes connections to external IPs using a where clause for not having a private IP range. Option A is wrong because it checks destination IP instead of source. Option B is wrong because it only checks last hour. Option D is wrong because it uses the wrong table.

Answer

DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where LocalIP == "10.0.0.5"
| where RemoteIP !startswith "10."

Answer

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP == "10.0.0.5"
| where ipv4_is_private(DestinationIP) == false

Answer

CommonSecurityLog
| where TimeGenerated > ago(1h)
| where SourceIP == "10.0.0.5"
| where ipv4_is_private(DestinationIP) == false

Question 4

During a threat hunt, an analyst notices multiple failed logon events from a single user account across different workstations within a short time window. Which hunting technique is most appropriate to detect potential lateral movement?

Accepted Answer

Search for failed logon events (Event ID 4625) followed by successful logon (Event ID 4624) from the same account on different machines.. Option A is correct because failed logons followed by successful logons from the same account can indicate lateral movement. Option B is wrong because it focuses on privilege escalation, not lateral movement. Option C is wrong because it's about data exfiltration. Option D is wrong because it's about account creation.

Answer

Search for multiple instances of special privileges assigned to new logon (Event ID 4672).

Answer

Search for large outbound RDP connections from a single host.

Answer

Search for creation of new user accounts (Event ID 4720).

Question 5

A threat hunter is using Microsoft Defender for Endpoint advanced hunting to find devices that have a specific file hash associated with a known malware variant. The analyst wants to include devices that have the file in any location, including quarantined items. Which table and column should be used?

Accepted Answer

DeviceFileEvents, SHA256. Option D is correct because DeviceFileEvents includes quarantined items. Option A is wrong because DeviceProcessEvents does not include file information. Option B is wrong because DeviceNetworkEvents is for network connections. Option C is wrong because DeviceImageLoadEvents is for loaded DLLs, not file discovery.

Answer

DeviceImageLoadEvents, SHA256

Answer

DeviceNetworkEvents, RemoteIP

Answer

DeviceProcessEvents, ProcessCommandLine

Question 6

A threat hunter wants to identify potential command and control (C2) communication by looking for DNS queries to domains with a high entropy and short TTL. Which advanced hunting query in Microsoft Defender XDR should be used?

Accepted Answer

DeviceNetworkEvents. Option B is correct because DeviceNetworkEvents includes DNS queries. Option A is wrong because IdentityLogonEvents is for logons. Option C is wrong because EmailEvents is for email. Option D is wrong because AlertInfo does not contain DNS details.

Answer

AlertInfo

Answer

IdentityLogonEvents

Answer

EmailEvents

Question 7

During a threat hunt, an analyst discovers a PowerShell script that was executed on multiple workstations with encoded commands. The analyst wants to find all instances of this script across the environment. Which hunting method in Microsoft Sentinel is most effective?

Accepted Answer

Search for the SHA256 hash of the script file in DeviceFileEvents.. Option C is correct because searching for the script hash across DeviceFileEvents will find any file with that hash, regardless of location. Option A is wrong because it only finds the script if it was executed via command line. Option B is wrong because it only finds it if it was run from Temp folder. Option D is wrong because it only finds it if it was downloaded via browser.

Answer

Search for the encoded command string in DeviceProcessEvents command line.

Answer

Search for the script in DeviceNetworkEvents as a downloaded file.

Answer

Search for the script file name in DeviceFileEvents where the folder path contains 'Temp'.

Question 8

A threat hunter wants to investigate a potential data exfiltration event involving large outbound file transfers to an unusual external IP. Which Microsoft Defender XDR advanced hunting table is most appropriate to start the investigation?

Accepted Answer

DeviceFileEvents. Option B is correct because DeviceFileEvents shows file creation and modification events, which can indicate large file copies. Option A is wrong because DeviceNetworkEvents shows network connections, not file transfers. Option C is wrong because DeviceProcessEvents shows process creation, not file transfers. Option D is wrong because IdentityDirectoryEvents shows identity events, not file transfers.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

IdentityDirectoryEvents

Question 9

Which TWO actions are valid when performing threat hunting in Microsoft Sentinel using hunting queries? (Choose two.)

Accepted Answer

Bookmark specific rows of results for later investigation.. Option A is correct because you can bookmark results for later investigation. Option C is correct because you can create a custom detection rule from a hunting query. Option B is wrong because hunting queries do not automatically trigger alerts; they are manual. Option D is wrong because you cannot directly export results to Azure Storage, only to a CSV file or Log Analytics. Option E is wrong because you cannot schedule a hunting query to run automatically; you would need to create an analytics rule.

Answer

Schedule a hunting query to run every hour.

Answer

Automatically trigger an alert when a hunting query returns results.

Answer

Export results directly to Azure Blob Storage.

Question 10

Which THREE data sources can be used in Microsoft Sentinel for threat hunting to detect unusual authentication patterns? (Choose three.)

Accepted Answer

SecurityEvent (Windows Event Logs). Option A is correct because SigninLogs from Microsoft Entra ID contain authentication data. Option B is correct because SecurityEvent (Windows Event Log) contains logon events. Option D is correct because AADNonInteractiveUserSignInLogs contain non-interactive sign-ins. Option C is wrong because OfficeActivity contains audit logs, not authentication. Option E is wrong because CommonSecurityLog is for network devices, not authentication.

Answer

CommonSecurityLog

Answer

OfficeActivity (Office 365)

Question 11

Which TWO techniques are commonly used in threat hunting to identify potential malicious activity? (Choose two.)

Accepted Answer

Searching for known indicators of compromise (IoCs).. Option A is correct because searching for known indicators of compromise (IoCs) is a common technique. Option D is correct because analyzing anomalies in baseline behavior is a core hunting technique. Option B is wrong because threat hunting is proactive, not just reactive. Option C is wrong because disabling security controls is not a hunting technique. Option E is wrong because threat hunting is typically performed by humans, not fully automated.

Answer

Disabling security controls to observe attacker behavior.

Answer

Waiting for alerts from automated detection tools.

Answer

Automatically blocking all suspicious traffic.

Question 12

A threat hunter is investigating a potential compromise involving a user account that has been used to sign in from multiple locations within a short time. The hunter wants to use Microsoft Sentinel to find all sign-in events for that user from different IP addresses in the last 24 hours. Which KQL query should be used?

Accepted Answer

SigninLogs
| where TimeGenerated > ago(24h)
| where UserPrincipalName == "user@domain.com"
| summarize count() by IPAddress. Option D is correct because SigninLogs contains user sign-in data and the query groups by UserPrincipalName and IP address. Option A is wrong because AuditLogs contains administrative actions, not sign-ins. Option B is wrong because SecurityEvent is for Windows events, not cloud sign-ins. Option C is wrong because CommonSecurityLog is for network devices.

Answer

SecurityEvent
| where TimeGenerated > ago(24h)
| where TargetUserName == "user@domain.com"
| summarize count() by IpAddress

Answer

AuditLogs
| where TimeGenerated > ago(24h)
| where InitiatedBy.user.userPrincipalName == "user@domain.com"
| summarize count() by IPAddress

Answer

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceUserID == "user@domain.com"
| summarize count() by SourceIP

Question 13

A threat hunter is analyzing a potential advanced persistent threat (APT) that uses living-off-the-land binaries (LOLBins) like certutil.exe to download payloads. The hunter wants to find instances where certutil.exe was used to download files from the internet in the last week. Which KQL query in Microsoft Sentinel would be most effective?

Accepted Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "certutil.exe"
| where ProcessCommandLine contains "-urlcache" or ProcessCommandLine contains "-split"
| project Timestamp, DeviceName, ProcessCommandLine. Option A is correct because it looks for certutil.exe with a URL parameter in the command line. Option B is wrong because it looks for mshta.exe. Option C is wrong because it looks for wscript.exe. Option D is wrong because it looks for powershell.exe.

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-enc"
| project Timestamp, DeviceName, ProcessCommandLine

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "mshta.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "wscript.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine

Question 14

Refer to the exhibit. You are analyzing a potential C2 communication pattern. The KQL query returns no results despite known malicious IPs being active. What is the most likely cause?

Accepted Answer

The devices generating the events are not onboarded to Microsoft Defender for Endpoint.. Option C is correct because DeviceNetworkEvents logs network events from Microsoft Defender for Endpoint, which may not capture all inbound/outbound traffic if the device is not onboarded or if network filtering is applied. Option A is wrong because the query does not filter on ActionType. Option B is wrong because the query includes both inbound and outbound events by default. Option D is wrong because the query uses RemoteIP which is the correct field for destination IP.

Answer

The query is missing a filter for Direction equal to 'Outbound'.

Answer

The query does not include a filter for ActionType equal to 'ConnectionSuccess'.

Answer

The RemoteIP field should be replaced with DestinationIpAddress.

Question 15

Your security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to correlate Azure AD sign-in logs with Microsoft Defender for Cloud Apps alerts. Which KQL operator should they use to join the two tables on the user principal name?

Accepted Answer

join. Option B is correct because the 'join' operator merges rows from two tables based on a matching key. Option A is incorrect because 'union' appends rows, not correlates. Option C is incorrect because 'lookup' is a type of join but is less common for this scenario. Option D is incorrect because 'evaluate' is used for plugin execution, not joining tables.

Answer

union

Answer

lookup

Answer

evaluate

SC-200 Perform threat hunting Practice Test 12 — 15 Questions

Exhibit

SC-200 Perform threat hunting Practice Test 12 — 15 Questions

Exhibit