SC-200 Perform threat hunting Practice Test 14 — 15 Questions

Question 1

An organization uses Microsoft Defender for Endpoint (MDE) to hunt for signs of credential dumping. An analyst runs a custom advanced hunting query that searches for processes accessing LSASS.exe. The query uses DeviceProcessEvents and DeviceFileEvents. The analyst notices that some known credential dumping tools are detected, but they want to find previously unknown variants. Which approach should the analyst take to improve the hunt?

Accepted Answer

Look for anomalous LSASS access patterns using process lineage and call stacks.. Option C is correct because hunting for anomalous LSASS access patterns (e.g., unusual call stacks, rare processes) helps discover novel tools. Option A is wrong because adding more signatures only catches known variants. Option B is wrong because focusing on file reputation may miss fileless or signed malicious tools. Option D is wrong because MDE already collects LSASS access events; enabling additional logging is not the primary issue.

Answer

Enable LSASS auditing via Windows Security Event Log.

Answer

Focus on file reputation data to exclude clean files.

Answer

Add more signature-based indicators to the query.

Question 2

A threat hunter wants to identify possible data exfiltration over DNS in Microsoft Sentinel. Which KQL function should the analyst use to extract domain names from DNS queries?

Accepted Answer

parse_url. Option B is correct because parse_url extracts URL components, including hostname, from a string. Option A is wrong because extract_all is more general for regex. Option C is wrong because split is for splitting strings, not parsing URLs. Option D is wrong because substring is for simple substring extraction.

Answer

split

Answer

extract_all

Answer

substring

Question 3

Refer to the exhibit. The KQL query is used for threat hunting. What is the primary purpose of this query?

Accepted Answer

Identify devices where cmd.exe launched PowerShell and made outbound HTTPS connections.. Option D is correct because the query joins cmd.exe executions containing 'powershell' with network connections to port 443 on the same device, indicating possible PowerShell download cradles. Option A is wrong because the query does not inspect process integrity levels. Option B is wrong because the query focuses on cmd.exe, not generic script execution. Option C is wrong because the query is not limited to lateral movement; it targets command and control activity.

Answer

Find devices where PowerShell was used to download files.

Answer

Detect lateral movement using remote services.

Answer

Identify cmd.exe running with high integrity.

Question 4

Refer to the exhibit. An analyst is reviewing a custom detection rule in Microsoft Sentinel. The rule is triggering many false positives from legitimate remote desktop connections. What should the analyst do to reduce false positives while keeping detection of pass-the-hash attacks?

Accepted Answer

Add an exclusion for known administrative jump boxes.. Option A is correct because adding a condition to exclude management jump boxes that use NTLM would remove known legitimate activity. Option B is wrong because changing logon type to 10 (remote interactive) would exclude many legitimate RDP connections. Option C is wrong because removing the NTLM filter would include all authentication packages, increasing false positives. Option D is wrong because the query already uses SecurityEvent; switching to Event table would not help.

Answer

Change the data source from SecurityEvent to Event.

Answer

Remove the AuthenticationPackage filter to include all packages.

Answer

Change LogonType to 10 to target remote interactive logons.

Question 5

A threat hunter is investigating a potential data exfiltration via DNS tunneling. Which Microsoft Defender XDR advanced hunting table should the analyst primarily use to examine DNS queries from endpoints?

Accepted Answer

DeviceNetworkEvents. Option A is correct because DeviceNetworkEvents contains DNS query records from endpoints. Option B is wrong because IdentityLogonEvents is for authentication events. Option C is wrong because EmailEvents is for email-related events. Option D is wrong because AlertInfo provides alert metadata, not raw DNS queries.

Answer

IdentityLogonEvents

Answer

AlertInfo

Answer

EmailEvents

Question 6

An analyst is using Microsoft Sentinel to hunt for signs of privilege escalation via token manipulation. Which Windows Security Event ID should the analyst focus on to detect potential token duplication or manipulation?

Accepted Answer

4672 - Special privileges assigned to new logon. Option B is correct because Event ID 4672 (Special Logon) is generated when a user is assigned special privileges, often associated with token manipulation. Option A is wrong because 4624 is a logon event, not specifically token-related. Option C is wrong because 4648 indicates explicit credentials were used. Option D is wrong because 4688 is a process creation event.

Answer

4688 - A new process has been created

Answer

4624 - An account was successfully logged on

Answer

4648 - A logon was attempted using explicit credentials

Question 7

Refer to the exhibit. The query is designed to hunt for potentially compromised accounts that are not on the suspicious list but have many network logons. However, the query returns zero results even though the analyst suspects there should be some hits. What is the most likely issue?

Accepted Answer

The LogonProcessName filter uses an incorrect string.. Option C is correct because the typo 'NtLmSsp' should be 'NtLmSsp' (note the capital L and M). The correct process name is 'NtLmSsp' (spelled with capital L and M). Option A is wrong because the time range is not specified but defaults to last 24h; this would not cause zero results. Option B is wrong because the dynamic array syntax is correct. Option D is wrong because the summarize function works correctly.

Answer

The time range filter is missing; no events are returned.

Answer

The dynamic array syntax is incorrect.

Answer

The summarize function cannot be used after a where clause.

Question 8

Which TWO data sources are commonly used in Microsoft Sentinel for threat hunting related to lateral movement? (Select TWO.)

Accepted Answer

SecurityEvent. Options B and C are correct because SecurityEvent (Windows events) and DeviceNetworkEvents (network connections) are key for detecting lateral movement. Option A is wrong because SigninLogs are for cloud sign-ins, not lateral movement. Option D is wrong because OfficeActivity is for Office 365, not lateral movement. Option E is wrong because AuditLogs are for directory changes, not lateral movement.

Answer

SigninLogs

Answer

OfficeActivity

Answer

AuditLogs

Question 9

Which THREE techniques are commonly used in Microsoft Sentinel threat hunting to identify command and control (C2) communication? (Select THREE.)

Accepted Answer

Detecting DNS tunneling. Options A, B, and E are correct because analyzing beaconing patterns, detecting DNS tunneling, and examining SSL/TLS certificates are common C2 detection methods. Option C is wrong because brute force detection is for credential attacks, not C2. Option D is wrong because analyzing email headers is for phishing, not C2.

Answer

Analyzing email headers for phishing

Answer

Identifying brute force attempts

Question 10

Which THREE actions should a threat hunter take when using Microsoft Defender XDR advanced hunting to investigate a potential ransomware outbreak? (Select THREE.)

Accepted Answer

Check for service installation events that mimic system services.. Options A, C, and E are correct because correlating process creation with file modifications, inspecting scheduled tasks, and checking for service installation are key steps to identify ransomware behavior. Option B is wrong because reviewing mailbox audit logs is not relevant for ransomware on endpoints. Option D is wrong because reviewing password changes is not directly related to ransomware.

Answer

Review mailbox audit logs for email forwarding rules.

Answer

Review password change events for service accounts.

Question 11

Refer to the exhibit. The query is intended to find devices where PowerShell was used with encoded commands and connected to specific remote IPs. However, the analyst notices that the query returns no results. What is the most likely reason?

Accepted Answer

The join key DeviceName does not exist in DeviceNetworkEvents.. Option C is correct because the join condition uses DeviceName, but the inner join requires matching DeviceName in both tables. If DeviceNetworkEvents does not have a DeviceName field (it uses DeviceId), the join fails. Option A is wrong because the time range is valid. Option B is wrong because the dynamic array syntax is correct. Option D is wrong because the use of has_any is correct for multiple strings.

Answer

The has_any operator is incorrect; should use contains.

Answer

The dynamic array syntax is incorrect.

Answer

The time range is too short.

Question 12

Refer to the exhibit. An analyst is reviewing this custom detection rule in Microsoft Sentinel. The rule is not generating any alerts even though services are being installed on servers. What is the most likely reason?

Accepted Answer

The where clause filters for legitimate services only.. Option B is correct because the where clause filters for ServiceName starting with 'Legit', which is a legitimate prefix, so it will only alert on services that start with 'Legit', which is the opposite of what is intended. Option A is wrong because ActionType is correct. Option C is wrong because the extend functions are correct. Option D is wrong because the trigger threshold is 0, meaning any result triggers an alert.

Answer

The extend functions are incorrectly parsing the AdditionalFields.

Answer

The ActionType filter is incorrect.

Answer

The triggerThreshold should be set to a higher value.

Question 13

A threat hunter wants to use Microsoft Defender for Cloud Apps to hunt for suspicious OAuth app permissions. Which activity type should the analyst investigate?

Accepted Answer

OAuth app granting permissions. Option D is correct because granting OAuth permissions is a key indicator of potential abuse. Option A is wrong because file downloads are not directly related to OAuth permissions. Option B is wrong because mailbox forwarding is an email rule, not OAuth. Option C is wrong because logon failures are authentication events.

Answer

Failed logon attempts

Answer

File download from SharePoint

Answer

Mailbox forwarding rule created

Question 14

You are a security analyst performing threat hunting in Microsoft Sentinel. You suspect an adversary is using living-off-the-land binaries (LOLBins) to execute code. Which KQL function should you use to search for processes spawned by a specific parent process across multiple machines?

Accepted Answer

search. Option C is correct because 'search' can scan across tables for a pattern, but for process ancestry queries, joining DeviceProcessEvents with DeviceEvents is common. However, the best approach is to use 'let' to define a lookup and then use 'join'. The question expects knowledge of 'search' as a broad tool. Option A is wrong because 'union' combines tables, not specifically parent-child relationships. Option B is wrong because 'find' searches across tables but is less efficient. Option D is wrong because 'evaluate' is for plugin execution.

Answer

find

Answer

evaluate

Answer

union

Question 15

Refer to the exhibit. You are threat hunting for possible lateral movement using cmd.exe. The KQL query returns no results even though you know cmd.exe was executed. What is the most likely reason?

Accepted Answer

The join key should be on DeviceName instead of DeviceId because DeviceProcessEvents uses DeviceName.. Option B is correct because the join key is DeviceId, but DeviceProcessEvents and DeviceEvents may use different column names (e.g., DeviceName vs DeviceId). Option A is wrong because timestamps are often not exactly equal; a join on time is not required. Option C is wrong because the join type is inner, which returns only matching rows. Option D is wrong because the query does not filter on a specific device, so all devices are included.

Answer

The query filters on a specific device name that is missing from the data.

Answer

The join type should be leftouter to include all process events even if no corresponding device event exists.

Answer

The join condition should include a time window; process creation events may have slightly different timestamps.