SC-200 Perform threat hunting Practice Test 13 — 15 Questions

Question 1

During a threat hunt, you discover a PowerShell script that downloads and executes a payload from a remote server. Which Microsoft Defender for Endpoint action type would most likely capture this behavior in DeviceEvents?

Accepted Answer

PowerShellCommand. Option D is correct because PowerShell commands that download and execute scripts are typically logged as 'PowerShellCommand' in DeviceEvents. Option A is incorrect because 'ProcessCreated' would show the PowerShell process creation but not the script content. Option B is incorrect because 'FileCreated' would show the payload file but not the download execution. Option C is incorrect because 'NetworkConnection' would show the connection but not the script execution.

Answer

ProcessCreated

Answer

FileCreated

Answer

NetworkConnection

Question 2

Refer to the exhibit. You are reviewing a custom scheduled analytics rule in Microsoft Sentinel. The rule is enabled but has not fired any alerts despite users having multiple locations in the last day. What is the most likely reason?

Accepted Answer

The 'Location' field does not exist in SigninLogs; the query returns an error silently.. Option B is correct because the query uses the default SigninLogs schema which includes 'Location' as a string, not 'Location' as a column. The correct column is 'LocationDetails' or the query should parse location from IP. Option A is incorrect because the rule is enabled. Option C is incorrect because the query period and frequency are set correctly. Option D is incorrect because the query summarizes by UserPrincipalName, which is a common field.

Answer

The UserPrincipalName field is case-sensitive and the data has mixed case.

Answer

The query frequency is set to 1 hour, but the query period is 1 day, causing a mismatch.

Answer

The rule is disabled.

Question 3

Your threat hunting team wants to identify all email messages that contained a specific malicious attachment hash in Microsoft 365. Which Microsoft Defender XRB data source should they query in Microsoft Sentinel?

Accepted Answer

EmailEvents. Option C is correct because EmailEvents in Microsoft Defender for Office 365 contains information about email messages including attachment hashes. Option A is incorrect because DeviceEvents is for endpoint events. Option B is incorrect because EmailAttachmentInfo is a separate table but EmailEvents is more comprehensive. Option D is incorrect because AlertEvidence is for alerts, not raw email data.

Answer

EmailAttachmentInfo

Answer

AlertEvidence

Answer

DeviceEvents

Question 4

While hunting for lateral movement, you want to find out which devices have established remote PowerShell sessions to other devices. Which Microsoft Defender for Endpoint advanced hunting table should you query?

Accepted Answer

DeviceNetworkEvents. Option B is correct because DeviceNetworkEvents contains network connections that can indicate remote PowerShell sessions (port 5985/5986). Option A is incorrect because DeviceProcessEvents shows process creation, not network connections. Option C is incorrect because DeviceEvents shows general events. Option D is incorrect because DeviceLogonEvents shows logon events, not network sessions.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

DeviceLogonEvents

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During a threat hunt, you want to identify AWS resources that have been compromised by correlating AWS CloudTrail logs with Microsoft Defender for Cloud security alerts. How should you ingest AWS CloudTrail logs into Microsoft Sentinel?

Accepted Answer

Use the AWS S3 connector in Microsoft Sentinel.. Option A is correct because AWS CloudTrail logs can be ingested via the AWS S3 connector in Microsoft Sentinel. Option B is incorrect because Microsoft Defender for Cloud does not natively ingest CloudTrail logs. Option C is incorrect because Azure Policy cannot ingest AWS logs. Option D is incorrect because the Microsoft 365 Defender connector is for Microsoft 365 data, not AWS.

Answer

Configure Microsoft Defender for Cloud to receive AWS CloudTrail logs.

Answer

Use the Microsoft 365 Defender connector to ingest CloudTrail logs.

Answer

Use Azure Policy to export CloudTrail logs to Log Analytics.

Question 6

You are hunting for privileged account abuse in Microsoft Entra ID. Which table in Microsoft Sentinel contains audit logs for changes to directory roles?

Accepted Answer

AuditLogs. Option D is correct because AuditLogs in Microsoft Entra ID contain directory role changes. Option A is incorrect because SigninLogs contains sign-in events. Option B is incorrect because DeviceLogonEvents is for device logons. Option C is incorrect because IdentityLogonEvents is for identity protection events.

Answer

IdentityLogonEvents

Answer

SigninLogs

Answer

DeviceLogonEvents

Question 7

Refer to the exhibit. You are investigating a user account that shows multiple logons to the Azure Portal from various countries within a short time. The query returns no results despite known logons. What is the most likely issue?

Accepted Answer

IdentityLogonEvents does not contain Azure Portal logon events; use AADSignInEventsBeta instead.. Option A is correct because IdentityLogonEvents is a table in Microsoft Defender for Identity (now part of Microsoft Defender XDR), but it logs events from domain controllers, not Azure Portal logons. Azure Portal logons are in AADSignInEventsBeta. Option B is incorrect because the query uses Timestamp. Option C is incorrect because AccountUpn is a valid field. Option D is incorrect because the filter on Application is valid.

Answer

The Timestamp filter should be Timestamp > ago(7d) but instead it's written incorrectly.

Answer

The AccountUpn field is not present in IdentityLogonEvents.

Answer

The Application filter should be 'Azure Portal' in a different case.

Question 8

Which TWO actions are part of the threat hunting process in Microsoft Sentinel?

Accepted Answer

Creating custom hunting queries based on hypotheses.. Options A and C are correct. A is correct because creating hunting queries is a key activity. C is correct because bookmarks allow tracking interesting findings. B is incorrect because configuring alert rules is part of detection, not hunting. D is incorrect because setting up data connectors is an initial setup step, not a hunting activity. E is incorrect because fine-tuning analytical rules is detection engineering.

Answer

Setting up data connectors to ingest logs.

Answer

Fine-tuning the severity of analytical rules.

Answer

Configuring scheduled analytics rules.

Question 9

Which THREE data sources can be used in Microsoft Sentinel for threat hunting involving network traffic?

Accepted Answer

DeviceNetworkEvents. Options B, C, and D are correct. B is correct because CommonSecurityLog (Syslog) contains network device logs. C is correct because DeviceNetworkEvents from Microsoft Defender for Endpoint contains network events. D is correct because WireData logs network traffic from Azure VMs. A is incorrect because SigninLogs is for authentication, not network traffic. E is incorrect because OfficeActivity is for Office 365 logs.

Answer

SigninLogs

Answer

OfficeActivity

Question 10

Which TWO are common techniques used during threat hunting to identify suspicious behavior in Microsoft Defender XDR?

Accepted Answer

Searching for known indicators of compromise (IOCs).. Options B and D are correct. B is correct because anomaly detection is a common hunting technique. D is correct because searching for known IOCs (indicators of compromise) is fundamental. A is incorrect because vulnerability scanning is not a hunting technique. C is incorrect because patch management is a maintenance activity. E is incorrect because configuring mail flow is administrative.

Answer

Updating antivirus signatures.

Answer

Configuring mail flow rules in Exchange Online.

Answer

Performing vulnerability scans on endpoints.

Question 11

Which THREE Microsoft Sentinel features are specifically designed to assist with threat hunting?

Accepted Answer

Livestream for real-time hunting.. Options A, C, and D are correct. A is correct because the Hunting blade is dedicated to hunting. C is correct because bookmarks allow preserving findings. D is correct because Livestream provides real-time hunting. B is incorrect because Workbooks are for visualization, not hunting. E is incorrect because Automation rules are for incident response, not hunting.

Answer

Workbooks for interactive dashboards.

Answer

Automation rules to respond to incidents.

Question 12

Which TWO tables in Microsoft Defender XDR advanced hunting provide information about user authentication events?

Accepted Answer

AADSignInEventsBeta. Options A and D are correct. A is correct because AADSignInEventsBeta contains Azure AD sign-ins. D is correct because IdentityLogonEvents contains on-premises AD logons. B is incorrect because DeviceNetworkEvents is for network events. C is incorrect because EmailEvents is for email. E is incorrect because AlertInfo is for alerts.

Answer

AlertInfo

Answer

EmailEvents

Answer

DeviceNetworkEvents

Question 13

Which THREE are valid methods to create a custom hunting query in Microsoft Sentinel?

Accepted Answer

Save a query from the Logs blade to the Hunting blade.. Options A, C, and D are correct. A is correct because you can use the Logs blade to write KQL. C is correct because you can start from a built-in template and edit. D is correct because you can save a query from Logs to Hunting. B is incorrect because the Analytics blade is for alert rules, not hunting. E is incorrect because Playbooks are for automation, not queries.

Answer

Use the Playbook blade to generate a query.

Answer

Create a new analytics rule in the Analytics blade.

Question 14

A security analyst is reviewing a threat hunting query in Microsoft Sentinel that uses the Kusto Query Language (KQL) to identify potential lateral movement. The query returns a large number of false positives. What is the most effective way to reduce false positives while maintaining detection coverage?

Accepted Answer

Add allowlist conditions to exclude known administrative tools.. Option B is correct because adding allowlist conditions, such as excluding known administrative tools or approved remote management traffic, directly reduces false positives without removing the core logic. Option A is wrong because reducing the time range may miss true positives. Option C is wrong because the question asks to maintain detection coverage, and using a less sensitive data source would reduce coverage. Option D is wrong because increasing the threshold may also miss true positives.

Answer

Increase the threshold for the anomaly score in the query.

Answer

Reduce the time range of the query to the last 1 hour.

Answer

Replace the query with a different data source that has less noise.

Question 15

During a threat hunting exercise, an analyst discovers a suspicious PowerShell process that executed encoded commands and made outbound connections to an unknown IP address. The process tree shows it was spawned by a Microsoft Word instance. What is the most likely attack technique being observed?

Accepted Answer

Phishing with malicious macro. Option B is correct because the scenario describes a malicious document (Word) executing PowerShell with encoded commands, which is classic phishing with macro-based payload. Option A is wrong because execution via rundll32 is not indicated. Option C is wrong because the attack originates from a document, not a service. Option D is wrong because there is no evidence of lateral movement.

Answer

Service Execution

Answer

Execution via Rundll32

Answer

Lateral Movement via WMI