SC-200 Perform threat hunting Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. You are investigating a user account that shows multiple logons to the Azure Portal from various countries within a short time. The query returns no results despite known logons. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IdentityLogonEvents does not contain Azure Portal logon events; use AADSignInEventsBeta instead.. IdentityLogonEvents (from Microsoft Defender for Identity/Defender XDR) contains logon events from domain controllers, not cloud-based logons to Azure Portal. Azure Portal logons are recorded in AADSignInEventsBeta. Option A is incorrect because the Timestamp filter syntax is not the issue; the query would still fail even if corrected. Option B is incorrect because AccountUpn is a valid field in IdentityLogonEvents, but the table lacks the relevant events. Option C is incorrect because the Application filter case is not the problem—Azure Portal logons simply do not appear in IdentityLogonEvents.

Answer

The Timestamp filter should be Timestamp > ago(7d) but instead it's written incorrectly.

Answer

The AccountUpn field is not present in IdentityLogonEvents.

Answer

The Application filter should be 'Azure Portal' in a different case.

Question 2

Which TWO actions are part of the threat hunting process in Microsoft Sentinel?

Accepted Answer

Creating custom hunting queries based on hypotheses.. Options A and B are correct. A is correct because creating custom hunting queries based on hypotheses is a core threat hunting activity in Microsoft Sentinel. B is correct because using bookmarks to preserve interesting findings allows hunters to save and revisit potential leads. C is incorrect because setting up data connectors is an initial setup step, not a hunting activity. D is incorrect because fine-tuning the severity of analytical rules belongs to detection engineering, not hunting. E is incorrect because configuring scheduled analytics rules is part of automated detection, not hunting.

Answer

Setting up data connectors to ingest logs.

Answer

Fine-tuning the severity of analytical rules.

Answer

Configuring scheduled analytics rules.

Question 3

Which THREE data sources can be used in Microsoft Sentinel for threat hunting involving network traffic?

Accepted Answer

DeviceNetworkEvents. Options A, B, and C are correct. A is correct because DeviceNetworkEvents from Microsoft Defender for Endpoint contains network events. B is correct because CommonSecurityLog (Syslog) contains network device logs. C is correct because WireData logs network traffic from Azure VMs. D is incorrect because SigninLogs is for authentication, not network traffic. E is incorrect because OfficeActivity is for Office 365 logs.

Answer

SigninLogs

Answer

OfficeActivity

Question 4

Which TWO are common techniques used during threat hunting to identify suspicious behavior in Microsoft Defender XDR?

Accepted Answer

Searching for known indicators of compromise (IOCs).. Options B and C are correct. B is correct because searching for known indicators of compromise (IOCs) is a fundamental threat hunting technique that helps identify known malicious activity. C is correct because applying anomaly detection models to user behavior is a common method to uncover suspicious patterns that deviate from baseline activity. A is incorrect because updating antivirus signatures is a preventive maintenance task, not a hunting technique. D is incorrect because configuring mail flow rules is an administrative configuration task. E is incorrect because vulnerability scanning is a separate assessment activity, not part of active threat hunting.

Answer

Updating antivirus signatures.

Answer

Configuring mail flow rules in Exchange Online.

Answer

Performing vulnerability scans on endpoints.

Question 5

Which THREE Microsoft Sentinel features are specifically designed to assist with threat hunting?

Accepted Answer

Livestream for real-time hunting.. Options A, C, and E are correct. A is correct because Livestream enables real-time hunting by allowing analysts to monitor incoming data and execute queries continuously. C is correct because Bookmarks allow preserving interesting results for later review and collaboration during hunting. E is correct because the Hunting blade provides built-in and custom queries specifically designed for proactive threat hunting. B is incorrect because Workbooks are visualization tools for reporting and dashboards, not for hunting. D is incorrect because Automation rules are used for incident response and automation, not for hunting.

Answer

Workbooks for interactive dashboards.

Answer

Automation rules to respond to incidents.

Question 6

Which TWO tables in Microsoft Defender XDR advanced hunting provide information about user authentication events?

Accepted Answer

AADSignInEventsBeta. Options B and D are correct. B is correct because AADSignInEventsBeta contains Azure AD sign-in events. D is correct because IdentityLogonEvents contains on-premises Active Directory logon events. Option A (AlertInfo) is incorrect because it stores security alert metadata, not authentication events. Option C (EmailEvents) is incorrect because it contains email-related events. Option E (DeviceNetworkEvents) is incorrect because it focuses on network connections.

Answer

AlertInfo

Answer

EmailEvents

Answer

DeviceNetworkEvents

Question 7

Which THREE are valid methods to create a custom hunting query in Microsoft Sentinel?

Accepted Answer

Save a query from the Logs blade to the Hunting blade.. Options C, D, and E are correct. C is correct because you can save a query from the Logs blade to the Hunting blade. D is correct because you can write a new KQL query in the Logs blade. E is correct because you can clone an existing built-in hunting query and modify it. Options A and B are incorrect: A is incorrect because the Playbook blade is for automation, not for generating queries; B is incorrect because the Analytics blade is for creating analytics rules (alert rules), not for hunting queries.

Answer

Use the Playbook blade to generate a query.

Answer

Create a new analytics rule in the Analytics blade.

Question 8

A security analyst is reviewing a threat hunting query in Microsoft Sentinel that uses the Kusto Query Language (KQL) to identify potential lateral movement. The query returns a large number of false positives. What is the most effective way to reduce false positives while maintaining detection coverage?

Accepted Answer

Add allowlist conditions to exclude known administrative tools.. Adding allowlist conditions, such as excluding known administrative tools or approved remote management traffic, directly reduces false positives without removing the core logic. Option A is wrong because increasing the threshold may miss true positives. Option C is wrong because reducing the time range may miss true positives and does not address false positives. Option D is wrong because changing the data source may reduce detection coverage and does not necessarily reduce false positives in the current query.

Answer

Increase the threshold for the anomaly score in the query.

Answer

Reduce the time range of the query to the last 1 hour.

Answer

Replace the query with a different data source that has less noise.

Question 9

During a threat hunting exercise, an analyst discovers a suspicious PowerShell process that executed encoded commands and made outbound connections to an unknown IP address. The process tree shows it was spawned by a Microsoft Word instance. What is the most likely attack technique being observed?

Accepted Answer

Phishing with malicious macro. The scenario describes a malicious document (Word) executing PowerShell with encoded commands, which is classic phishing with macro-based payload. Option A is wrong because execution via rundll32 is not indicated. Option C is wrong because the attack originates from a document, not a service. Option D is wrong because there is no evidence of lateral movement.

Answer

Service Execution

Answer

Execution via Rundll32

Answer

Lateral Movement via WMI

Question 10

An organization uses Microsoft Defender for Endpoint (MDE) to hunt for signs of credential dumping. An analyst runs a custom advanced hunting query that searches for processes accessing LSASS.exe. The query uses DeviceProcessEvents and DeviceFileEvents. The analyst notices that some known credential dumping tools are detected, but they want to find previously unknown variants. Which approach should the analyst take to improve the hunt?

Accepted Answer

Look for anomalous LSASS access patterns using process lineage and call stacks.. Analyzing anomalous LSASS access patterns, such as unusual processes accessing LSASS or suspicious call stacks, helps identify previously unknown credential dumping techniques that do not match existing signatures. Option A is incorrect because Microsoft Defender for Endpoint already collects LSASS access events via its built-in sensors; enabling additional Windows Security Event Log auditing is not necessary and does not directly help discover novel variants. Option B is incorrect because relying on file reputation may miss fileless attacks or signed malicious tools that are not yet categorized as malicious. Option C is incorrect because adding more signature-based indicators will only improve detection of known tools, not unknown variants.

Answer

Enable LSASS auditing via Windows Security Event Log.

Answer

Focus on file reputation data to exclude clean files.

Answer

Add more signature-based indicators to the query.

Question 11

A threat hunter wants to identify possible data exfiltration over DNS in Microsoft Sentinel. Which KQL function should the analyst use to extract domain names from DNS queries?

Accepted Answer

parse_url. Parse_url extracts URL components, including hostname, from a string. Option A is wrong because extract_all is more general for regex. Option C is wrong because split is for splitting strings, not parsing URLs. Option D is wrong because substring is for simple substring extraction.

Answer

split

Answer

extract_all

Answer

substring

Question 12

Refer to the exhibit. The KQL query is used for threat hunting. What is the primary purpose of this query?

Accepted Answer

Identify devices where cmd.exe launched PowerShell and made outbound HTTPS connections.. The query joins cmd.exe executions containing 'powershell' with network connections to port 443 on the same device, indicating possible PowerShell download cradles initiated from cmd.exe. Option B is wrong because the query focuses on cmd.exe, not generic PowerShell downloads. Option C is wrong because the query does not specifically detect lateral movement via remote services. Option D is wrong because the query does not inspect process integrity levels.

Answer

Find devices where PowerShell was used to download files.

Answer

Detect lateral movement using remote services.

Answer

Identify cmd.exe running with high integrity.

Question 13

Refer to the exhibit. An analyst is reviewing a custom detection rule in Microsoft Sentinel. The rule is triggering many false positives from legitimate remote desktop connections. What should the analyst do to reduce false positives while keeping detection of pass-the-hash attacks?

Accepted Answer

Add an exclusion for known administrative jump boxes.. Adding an exclusion for known administrative jump boxes reduces false positives by filtering out legitimate remote desktop connections from trusted hosts. Option A is wrong because changing the data source from SecurityEvent to Event would remove the necessary security event details. Option B is wrong because removing the AuthenticationPackage filter would include all packages, increasing false positives. Option C is wrong because changing LogonType to 10 (remote interactive) would exclude RDP connections that are not remote interactive, potentially missing attacks.

Answer

Change the data source from SecurityEvent to Event.

Answer

Remove the AuthenticationPackage filter to include all packages.

Answer

Change LogonType to 10 to target remote interactive logons.

Question 14

A threat hunter is investigating a potential data exfiltration via DNS tunneling. Which Microsoft Defender XDR advanced hunting table should the analyst primarily use to examine DNS queries from endpoints?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents contains DNS query records from endpoints. Option B is wrong because IdentityLogonEvents is for authentication events. Option C is wrong because AlertInfo provides alert metadata, not raw DNS queries. Option D is wrong because EmailEvents is for email-related events.

Answer

IdentityLogonEvents

Answer

AlertInfo

Answer

EmailEvents

Question 15

An analyst is using Microsoft Sentinel to hunt for signs of privilege escalation via token manipulation. Which Windows Security Event ID should the analyst focus on to detect potential token duplication or manipulation?

Accepted Answer

4672 - Special privileges assigned to new logon. Event ID 4672 (Special Logon) is generated when special privileges are assigned to a logon, which often indicates token manipulation (e.g., SeTcbPrivilege, SeDebugPrivilege). Option A (4688) is a process creation event and not specific to token manipulation. Option C (4624) is a logon event, not specifically related to token manipulation. Option D (4648) indicates logon using explicit credentials, which is not directly associated with token duplication.

Answer

4688 - A new process has been created

Answer

4624 - An account was successfully logged on

Answer

4648 - A logon was attempted using explicit credentials