SC-200 Perform threat hunting Practice Test 14 — 15 Questions

Question 1

Refer to the exhibit. The query is designed to hunt for potentially compromised accounts that are not on the suspicious list but have many network logons. However, the query returns zero results even though the analyst suspects there should be some hits. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The LogonProcessName filter uses an incorrect string.. The LogonProcessName filter uses an incorrect string. In KQL, the process name for NTLM authentication is case-sensitive, commonly 'NtLmSsp'. If a typo is present (e.g., 'NTLM' or 'NTLMSSP'), no results will match. Option A is incorrect because the time range defaults to the last 24 hours in the query's context, which would still return events. Option C is incorrect because the dynamic array syntax (e.g., in() operator) is correctly used. Option D is incorrect because the summarize function can be used after a where clause; the query order is valid.

Answer

The time range filter is missing; no events are returned.

Answer

The dynamic array syntax is incorrect.

Answer

The summarize function cannot be used after a where clause.

Question 2

Which TWO data sources are commonly used in Microsoft Sentinel for threat hunting related to lateral movement? (Select TWO.)

Accepted Answer

SecurityEvent. Options B and D are correct because SecurityEvent captures Windows security events (e.g., 4624 for logons) and DeviceNetworkEvents captures network connections, both critical for identifying lateral movement. Option A (SigninLogs) tracks cloud sign-ins, not lateral movement. Option C (OfficeActivity) logs Office 365 operations, unrelated to lateral movement. Option E (AuditLogs) tracks directory changes, not network or host activity.

Answer

SigninLogs

Answer

OfficeActivity

Answer

AuditLogs

Question 3

Which THREE techniques are commonly used in Microsoft Sentinel threat hunting to identify command and control (C2) communication? (Select THREE.)

Accepted Answer

Detecting DNS tunneling. Options B, C, and D are correct because DNS tunneling (B), network beaconing patterns (C), and SSL/TLS certificate anomalies (D) are common techniques for detecting command and control (C2) communication in Microsoft Sentinel threat hunting. Option A is incorrect because analyzing email headers is used for phishing detection, not C2. Option E is incorrect because brute force attempts are related to credential attacks, not C2.

Answer

Analyzing email headers for phishing

Answer

Identifying brute force attempts

Question 4

Which THREE actions should a threat hunter take when using Microsoft Defender XDR advanced hunting to investigate a potential ransomware outbreak? (Select THREE.)

Accepted Answer

Check for service installation events that mimic system services.. Options A, C, and D are correct because checking for service installation events that mimic system services, inspecting scheduled tasks for persistence mechanisms, and correlating process creation events with file modification events are key steps to identify ransomware behavior. Option B is incorrect because reviewing mailbox audit logs for email forwarding rules is more relevant to email compromise rather than endpoint ransomware. Option E is incorrect because reviewing password change events for service accounts is not directly related to ransomware detection.

Answer

Review mailbox audit logs for email forwarding rules.

Answer

Review password change events for service accounts.

Question 5

Refer to the exhibit. The query is intended to find devices where PowerShell was used with encoded commands and connected to specific remote IPs. However, the analyst notices that the query returns no results. What is the most likely reason?

Accepted Answer

The join key DeviceName does not exist in DeviceNetworkEvents.. The join condition uses DeviceName to match rows from DeviceProcessEvents and DeviceNetworkEvents. If DeviceNetworkEvents does not contain a DeviceName field (e.g., it uses DeviceId instead), the join will fail silently and return no results. Option C is incorrect because the dynamic array syntax ('["IP1","IP2"]') is valid for has_any. Option B is incorrect because has_any is the appropriate operator for multiple values, while contains would be inefficient and less precise. Option D is incorrect because the time range (past 7 days) is reasonable and would not yield zero results if data existed.

Answer

The has_any operator is incorrect; should use contains.

Answer

The dynamic array syntax is incorrect.

Answer

The time range is too short.

Question 6

Refer to the exhibit. An analyst is reviewing this custom detection rule in Microsoft Sentinel. The rule is not generating any alerts even though services are being installed on servers. What is the most likely reason?

Accepted Answer

The where clause filters for legitimate services only.. The where clause filters for ServiceName starting with 'Legit', which indicates legitimate services only. Therefore, the rule will only generate alerts if a service with a name starting with 'Legit' is installed, which is the opposite of detecting suspicious installations. This is why no alerts are triggered despite services being installed. Option B is incorrect because the ActionType filter is correctly set. Option C is incorrect because the extend functions are parsing correctly. Option D is incorrect because the trigger threshold is 0, meaning any result triggers an alert, so the threshold is not the issue.

Answer

The extend functions are incorrectly parsing the AdditionalFields.

Answer

The ActionType filter is incorrect.

Answer

The triggerThreshold should be set to a higher value.

Question 7

A threat hunter wants to use Microsoft Defender for Cloud Apps to hunt for suspicious OAuth app permissions. Which activity type should the analyst investigate?

Accepted Answer

OAuth app granting permissions. Suspicious OAuth app permissions are directly indicated by the activity type 'OAuth app granting permissions'. Option A (Failed logon attempts) is incorrect because it relates to authentication failures, not OAuth permissions. Option B (File download from SharePoint) is incorrect because it concerns data access, not permission grants. Option C (Mailbox forwarding rule created) is incorrect because it involves email rules, not OAuth authorizations.

Answer

Failed logon attempts

Answer

File download from SharePoint

Answer

Mailbox forwarding rule created

Question 8

You are a security analyst performing threat hunting in Microsoft Sentinel. You suspect an adversary is using living-off-the-land binaries (LOLBins) to execute code. Which KQL function should you use to search for processes spawned by a specific parent process across multiple machines?

Accepted Answer

search. Search. In KQL, the 'search' operator allows you to search for a specific string across all tables and columns, making it suitable for finding processes spawned by a specific parent process across different machines and event types. For example, you can use `search "parent_process_name.exe"` to find related events. The other options: 'find' is similar but has different syntax and is less efficient; 'union' combines tables but does not pattern match; 'evaluate' is used for invoking plugins, not for searching.

Answer

find

Answer

evaluate

Answer

union

Question 9

Refer to the exhibit. You are threat hunting for possible lateral movement using cmd.exe. The KQL query returns no results even though you know cmd.exe was executed. What is the most likely reason?

Accepted Answer

The join key should be on DeviceName instead of DeviceId because DeviceProcessEvents uses DeviceName.. The join key is DeviceId, but DeviceProcessEvents uses DeviceName as the identifying column, not DeviceId. Therefore, the join on DeviceId fails to match records that actually occurred on the same device. The correct approach is to join on DeviceName or use a consistent column across both tables. Option B is incorrect because the query does not filter on a specific device name; it uses an inner join on DeviceId. Option C is incorrect because changing the join type to leftouter would not resolve the column mismatch; it would only include unmatched rows but still with incorrect matching keys. Option D is incorrect because while timestamps may differ, the primary issue is the column mismatch, not the time window.

Answer

The query filters on a specific device name that is missing from the data.

Answer

The join type should be leftouter to include all process events even if no corresponding device event exists.

Answer

The join condition should include a time window; process creation events may have slightly different timestamps.

Question 10

A threat hunter wants to identify anomalous DNS queries that may indicate data exfiltration. In Microsoft Sentinel, which data source is most appropriate for ingesting DNS logs from on-premises servers?

Accepted Answer

DNS connector using Azure Monitor Agent (AMA). The DNS connector using Azure Monitor Agent (AMA) is the most appropriate data source for ingesting DNS logs from on-premises Windows DNS servers. It collects DNS query and response logs directly and parses them into the normalized DNS schema. Option A (Syslog connector) is typically used for Linux-based logs and may not parse Windows DNS fields natively. Option C (Azure DNS connector) is for Azure-hosted DNS zones, not on-premises servers. Option D (Windows Event Forwarding) streams Windows events but does not specifically collect DNS query logs with the same depth as the DNS connector.

Answer

Syslog connector

Answer

Azure DNS connector

Answer

Windows Event Forwarding (WEF)

Question 11

You are using Microsoft Defender for Cloud Apps to hunt for suspicious OAuth app permissions. Which activity type should you look for to detect a potentially malicious app that was granted high privileges by a user?

Accepted Answer

Consent to application. 'Consent to application' (Option A). This activity captures when a user grants OAuth permissions to an application, which is the key indicator of high-privilege app consent. Option B, 'Add service principal', relates to creating a service principal object in Azure AD, not user consent. Option C, 'Update application', involves modifying an app's configuration, not consent. Option D, 'Add app role assignment grant', is about assigning an app role to a user or group, which is a separate permission grant that does not involve user consent directly.

Answer

Add service principal

Answer

Update application

Answer

Add app role assignment grant

Question 12

Refer to the exhibit. A threat hunter creates a scheduled analytics rule in Microsoft Sentinel using this query. The rule triggers frequently but generates many false positives. What is the best way to improve the rule's precision?

Accepted Answer

Add a filter on Severity to only include High and Medium alerts.. The query likely returns many low-severity alerts that are noise. By adding a filter on Severity to only include High and Medium alerts, the rule triggers only on more significant alerts, reducing false positives. Option B is incorrect because disabling MITRE ATT&CK technique mapping does not affect the query results or false positives. Option C is incorrect because adding EntityMapping improves incident enrichment but does not filter out false positives. Option D is incorrect because increasing the query frequency would run the query more often, potentially generating even more false positives.

Answer

Disable MITRE ATT&CK technique mapping.

Answer

Add EntityMapping to map the compromised entity to an account.

Answer

Increase the query frequency to run every hour.

Question 13

During a threat hunt, you identify a user account that has been logging in from multiple geographic regions within a short time. Which Microsoft Defender for Cloud Apps feature should you use to investigate this anomaly?

Accepted Answer

Activity log. The Activity log in Microsoft Defender for Cloud Apps provides detailed records of user activities, including login locations and times, making it ideal for investigating anomalies like logins from multiple geographic regions. Option A (Cloud Discovery) is used to identify shadow IT and cloud app usage, not user login anomalies. Option B (App permissions) focuses on permissions granted to OAuth apps, not user activity. Option C (File policy) is for monitoring and protecting files, not login events.

Answer

Cloud Discovery

Answer

App permissions

Answer

File policy

Question 14

You are investigating a potential data exfiltration using Microsoft Defender for Cloud Apps. You find that a user downloaded a large number of files from SharePoint Online to a personal device. Which anomaly detection policy type would have detected this?

Accepted Answer

Activity anomaly detection policy. Activity anomaly detection policies detect unusual download volumes. Option B is wrong because File anomaly policies focus on file types and metadata. Option C is wrong because Cloud Discovery anomaly policies focus on shadow IT. Option D is wrong because OAuth app anomaly policies focus on app permissions.

Answer

File anomaly detection policy

Answer

Cloud Discovery anomaly detection policy

Answer

OAuth app anomaly detection policy

Question 15

Refer to the exhibit. You are hunting for PowerShell used to launch cmd.exe. The query is intended to find cmd.exe processes that occurred after the first PowerShell execution on the same device. However, it returns no results. What is the most likely issue?

Accepted Answer

The FirstSeen variable is a table, not a scalar value; 'between' cannot be used with a table.. The subquery uses 'min(Timestamp)' which returns a scalar value, but the 'between' operator expects a scalar value on both sides. However, the main issue is that 'FirstSeen' in the 'where' clause is a tabular expression (result of the subquery), not a scalar. The 'between' operator cannot be used with a table; it requires scalar datetime values. Option A is wrong because filtering on a specific time range would not solve the fundamental issue of using a table in 'between'. Option B is wrong because the join key should be DeviceId, not DeviceName, as that is the common identifier. Option D is wrong because 'innerunique' would not change the fact that 'between' cannot accept a table.

Answer

The query should filter on a specific time range instead of using FirstSeen.

Answer

The join key should be DeviceName instead of DeviceId.

Answer

The join type should be innerunique, not leftsemi.