SC-200 Perform threat hunting Practice Test 15 — 15 Questions

Question 1

As a threat hunter, you want to use MITRE ATT&CK techniques to categorize detected behaviors. In Microsoft Sentinel, which feature allows you to map alerts to MITRE techniques automatically?

Accepted Answer

Analytics rules. Analytics rules in Microsoft Sentinel allow you to map alerts to MITRE ATT&CK techniques automatically. When creating or editing an analytics rule, you can select the relevant MITRE ATT&CK tactic and technique, which enriches the alert with threat intelligence context. Workbooks (Option D) are for visualization, not mapping. Playbooks (Option B) are for automated response. Watchlists (Option C) are for reference data. Therefore, Option A is correct.

Answer

Playbooks

Answer

Watchlists

Answer

Workbooks

Question 2

Which TWO are valid methods for performing threat hunting in Microsoft Sentinel? (Choose two.)

Accepted Answer

Using the Hunting blade with built-in queries. The Hunting blade provides built-in queries for threat hunting. Option D is correct because Jupyter notebooks with MSTICpy allow custom hunting queries. Option A is wrong because playbooks are for automation, not hunting. Option C is wrong because the MITRE ATT&CK dashboard is a visualization, not a hunting method. Option E is wrong because watchlists are data sources, not hunting methods.

Answer

Using playbooks to respond to incidents

Answer

Using the MITRE ATT&CK dashboard

Answer

Using watchlists to create alerts

Question 3

Which THREE are essential components of a threat hunting hypothesis in Microsoft Sentinel? (Choose three.)

Accepted Answer

Adversary goal or objective. A hypothesis should identify the adversary's objective. Option C is correct because it should specify the data sources to analyze. Option E is correct because it should define expected indicators of compromise. Option B is wrong because alert severity level is determined after detection, not part of the hypothesis. Option D is wrong because the automated response plan is separate from the hypothesis.

Answer

Alert severity level

Answer

Automated response plan

Question 4

Which TWO are valid KQL operators for performing time-based analysis in threat hunting? (Choose two.)

Accepted Answer

between. (between) is correct because it filters records where a datetime column falls within a specified range, essential for time-based analysis. Option E (ago()) is correct because it returns a datetime value relative to the current time (e.g., ago(7d) for 7 days ago), enabling dynamic time range filters. Option A (project) is wrong because it selects columns, not time-based operations. Option C (summarize) is wrong because it aggregates data, not specifically time-based. Option D (extend) is wrong because it adds computed columns, not time filters.

Answer

project

Answer

summarize

Answer

extend

Question 5

You are investigating a potential brute-force attack against Microsoft 365. Which KQL query in Microsoft Sentinel would best identify failed logon attempts from a single IP address across multiple users?

Accepted Answer

SigninLogs | summarize dcount(UserId) by IPAddress | where dcount_ > 10. It groups logon attempts by IP address, counts distinct UserIds per IP using dcount(), and filters for IPs with more than 10 distinct users. This effectively identifies a single IP address attempting to log in to multiple user accounts, which is characteristic of a brute-force attack. Option A is incorrect because it groups by UserId and counts distinct IPs per user, which identifies users logging in from multiple IPs, not attackers. Option B is incorrect because it counts total attempts per user, not across users. Option C is incorrect because it counts total attempts per IP, which would include many attempts from the same attacker targeting one user, not distinct users.

Answer

SigninLogs | summarize dcount(IPAddress) by UserId | where dcount_ > 10

Answer

SigninLogs | summarize count() by UserId | where count_ > 10

Answer

SigninLogs | summarize count() by IPAddress | where count_ > 10

Question 6

Refer to the exhibit. A threat hunter runs this PowerShell script to query Microsoft Sentinel. The script fails with an error stating that the query language is not recognized. What is the most likely cause?

Accepted Answer

The query contains a reference to a table that does not exist in the workspace.. The error 'query language not recognized' occurs because the Kusto Query Language (KQL) parser cannot resolve the table 'DeviceProcessEvents' referenced in the query. If the table does not exist in the Log Analytics workspace, the query fails with a 'language not recognized' error because the parser treats the undefined table reference as a syntax or semantic error. Options B, C, and D are incorrect because Invoke-AzOperationalInsightsQuery accepts a string query, 'search' is not required for cross-table queries, and pipe syntax is fully supported in KQL and by the cmdlet.

Answer

The cmdlet requires the query to be passed as a script block, not a string.

Answer

The query should use 'search' instead of 'where' for cross-table queries.

Answer

The query uses pipe syntax ('|') which is not supported by the PowerShell cmdlet.

Question 7

You are threat hunting for signs of credential dumping using Mimikatz. In Microsoft Defender for Identity, which type of alert would you expect to see?

Accepted Answer

Suspicious service creation. 'Suspicious service creation' is a common alert in Microsoft Defender for Identity when Mimikatz is installed as a service to perform credential dumping. Option A is incorrect because 'Pass-the-Hash attack' is a different technique that may follow credential dumping but is not the direct alert for Mimikatz installation. Option B is incorrect because 'Brute force attack' relates to password guessing, not credential dumping. Option D is incorrect because 'Reconnaissance using SMB' involves scanning, not service creation for credential dumping.

Answer

Pass-the-Hash attack

Answer

Reconnaissance using SMB

Answer

Brute force attack

Question 8

During a threat hunting exercise in Microsoft Sentinel, you want to identify all cloud application events where a user accessed a resource from an IP address not previously associated with that user. Which KQL operator should you use to compare current access patterns with a baseline of known IPs?

Accepted Answer

join. The `join` operator allows combining two tables based on a key, such as UserId, and then filtering for rows where the IP does not match the baseline.

Answer

lookup

Answer

summarize

Answer

union

Question 9

During a threat hunt, you identify a suspicious process execution chain in Microsoft Defender for Endpoint: `powershell.exe` spawned `cmd.exe` which then executed `rundll32.exe`. To investigate the parent-child relationships, which KQL statement should you use in Advanced Hunting?

Accepted Answer

DeviceProcessEvents | where ProcessChain has_all ("powershell.exe", "cmd.exe", "rundll32.exe"). Advanced Hunting in Microsoft Defender for Endpoint includes a `ProcessChain` column in `DeviceProcessEvents` that contains the full sequence of parent processes leading to the current process. Using `has_all` checks that all three executables appear in the chain in order, directly matching the suspicious execution pattern. Option A only checks the immediate parent (InitiatingProcessFileName), so it would miss scenarios where `cmd.exe` is not the direct parent of `rundll32.exe`. Option C summarizes by chain but does not filter for the specific chain. Option D joins on DeviceId without constraining parent-child relationships, leading to irrelevant results.

Answer

DeviceProcessEvents | where FileName == "rundll32.exe" and InitiatingProcessFileName == "cmd.exe"

Answer

DeviceProcessEvents | summarize by ProcessChain

Answer

DeviceProcessEvents | where FileName == "powershell.exe" | join kind=inner DeviceProcessEvents on $left.DeviceId == $right.DeviceId

Question 10

You are reviewing a custom analytics rule in Microsoft Sentinel. The rule is enabled but you notice that no alerts have been generated even though there are many matching events. What is the most likely cause?

Accepted Answer

The triggerThreshold of 5 requires at least 5 matching events in each hour.. The rule suppresses alerts for 5 hours after an alert is generated. Since suppression is enabled (suppressionEnabled: true? Actually the value is false, but the duration is set. Wait, suppressionEnabled is false, so suppression is disabled. However, the queryFrequency and queryPeriod are both 1 hour, and triggerThreshold is 5. If there are many matching events, the threshold might not be met if events are spread out. But the exhibit shows suppressionEnabled: false, so suppression is not the issue. The most likely cause is that the rule has a triggerThreshold of 5, meaning it requires at least 5 events in the query period. If there are fewer than 5, no alert is generated.

Answer

The rule is not associated with a data connector.

Answer

The queryPeriod is too short to capture events.

Answer

The rule is suppressed due to suppressionDuration of 5 hours.

Question 11

You are investigating a detection in Microsoft Defender for Endpoint. The PowerShell output shows a threat with ID 2147723152. Which type of threat does this ID represent?

Accepted Answer

HackTool. Threat ID 2147723152 corresponds to a hacktool (specifically, a tool used for penetration testing), often detected as 'HackTool:MSIL/Mimikatz!dha'.

Answer

Ransomware

Answer

Worm

Answer

Trojan

Question 12

A threat hunter runs the above KQL query in Microsoft Defender Advanced Hunting. What is the primary purpose of this query?

Accepted Answer

Detect logon attempts from new IP addresses for existing users.. The query creates a baseline of known AccountUpn and RemoteIP pairs from the past 30 days (excluding last day), then selects new logon events from the last day where the AccountUpn exists in baseline but the RemoteIP is not in the paired IP for that user. This detects logons from new IPs for existing users.

Answer

Create a list of all unique logon events in the last day.

Answer

Identify users who have not logged in within the past 30 days.

Answer

Find all logon events from IPs that have never been seen before.

Question 13

As part of a threat hunt, you want to find instances where a user successfully authenticated to multiple applications within a short time using different IP addresses. Which Microsoft 365 Defender data source would be most appropriate?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents contains authentication events for cloud apps, with columns like Application, IP address, and Timestamp.

Answer

CloudAppEvents

Answer

DeviceLogonEvents

Answer

AlertInfo

Question 14

During a threat hunt, you suspect a user may have exfiltrated data via email. Which Microsoft 365 Defender advanced hunting table should you query to review email attachments and their file hashes?

Accepted Answer

EmailAttachmentInfo. EmailAttachmentInfo contains details about email attachments, including file name, size, and SHA256 hash.

Answer

EmailUrlInfo

Answer

EmailEvents

Answer

EmailPostDeliveryEvents

Question 15

You are hunting for lateral movement in your environment. In Microsoft Defender for Identity, which activity is a strong indicator of a potential pass-the-hash attack?

Accepted Answer

An NTLM authentication originating from a machine that is not the user's usual machine.. Pass-the-hash attacks involve an attacker using a hash to authenticate as another user. An NTLM authentication using a hash from a different machine indicates this.

Answer

A user logging on with a smart card.

Answer

A remote desktop connection from a non-admin workstation to a domain controller.

Answer

A service account logging on to multiple servers simultaneously.