SC-200 Perform threat hunting Practice Test 16 — 15 Questions

Question 1

Which TWO KQL operators are commonly used in threat hunting to join tables based on a key?

Accepted Answer

lookup. Join and lookup are both used to combine tables based on keys. Union combines rows, summarize aggregates, extend adds columns.

Answer

extend

Answer

summarize

Answer

union

Question 2

Which THREE data sources in Microsoft Sentinel are most useful for threat hunting activities related to identity compromise?

Accepted Answer

SecurityEvent. SigninLogs (Azure AD), AuditLogs (Azure AD), and SecurityEvent (Windows) provide identity-related data. CommonSecurityLog is for network appliances, OfficeActivity for M365 workloads.

Answer

CommonSecurityLog

Answer

OfficeActivity

Question 3

Which THREE techniques are commonly used in threat hunting within Microsoft Defender XDR to detect privilege escalation?

Accepted Answer

Token manipulation. Token manipulation, process injection, and access token manipulation are common privilege escalation techniques. Data exfiltration is a goal, not technique; spearphishing is initial access.

Answer

Spearphishing attachment

Answer

Data exfiltration

Question 4

A threat hunter wants to identify all devices that have communicated with a known malicious IP address in the last 7 days. Which table in Microsoft Defender for Endpoint advanced hunting should be queried?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents records network connections, including destination IP addresses.

Answer

DeviceFileEvents

Answer

DeviceProcessEvents

Answer

DeviceRegistryEvents

Question 5

You are conducting a threat hunt to find evidence of credential dumping on Windows servers. Which event ID in Windows Security Event Log (SecurityEvent) is most indicative of LSASS process access?

Accepted Answer

4656 (Handle to an object requested). Event ID 4656 is generated when a handle to an object (like LSASS) is requested, often used in credential dumping.

Answer

4688 (Process creation)

Answer

4672 (Special privileges assigned)

Answer

4624 (Logon)

Question 6

During a threat hunt, you find a PowerShell script that decodes a base64-encoded command and executes it. Which MITRE ATT&CK technique is this behavior most associated with?

Accepted Answer

T1027 (Obfuscated Files or Information). Obfuscated Files or Information (T1027) includes encoding. PowerShell execution is also part of T1059.001, but the encoding aspect points to T1027.

Answer

T1059.001 (PowerShell)

Answer

T1055 (Process Injection)

Answer

T1003 (Credential Dumping)

Question 7

You are performing a threat hunt in Microsoft Sentinel. You want to identify devices that have been communicating with known malicious IP addresses. Which data source should you query?

Accepted Answer

CommonSecurityLog. CommonSecurityLog is the correct data source because it aggregates logs from various security appliances (e.g., firewalls, proxies) using the Syslog or CEF format. These logs typically contain source and destination IP addresses, making them ideal for correlating internal devices with known malicious IPs during a threat hunt. SecurityEvent and DeviceNetworkEvents lack the necessary network-level IP communication data, while DnsEvents only logs DNS queries, not direct IP connections.

Answer

SecurityEvent

Answer

DnsEvents

Answer

DeviceNetworkEvents

Question 8

During a threat hunt, you discover suspicious PowerShell commands executed on multiple workstations. Which KQL function in Microsoft Sentinel is most effective for aggregating similar commands to identify a pattern?

Accepted Answer

summarize. The `summarize` operator in KQL is specifically designed to aggregate data, such as grouping similar PowerShell commands using `make_list` or `count()`, making it the most effective choice for identifying patterns in threat hunting. Option B (`extend`) adds computed columns but does not aggregate. Option C (`search`) is for raw text search across tables. Option D (`project`) selects or reorders columns without aggregation.

Answer

extend

Answer

search

Answer

project

Question 9

You run the KQL query above in Microsoft Sentinel. The query returns zero results even though you know some devices have connected to malicious IPs. What is the most likely cause?

Accepted Answer

The externaldata source URL is inaccessible from the Sentinel workspace.. The externaldata source URL might be inaccessible from the Microsoft Sentinel workspace (e.g., firewall or permissions), causing the query to return zero results despite actual connections. Option B is incorrect because the malicious IPs are indeed present in the list loaded via externaldata; if the URL were accessible, the query would find matches. Option C is incorrect because the DeviceNetworkEvents table does contain the RemoteIP column, so that would not cause zero results. Option D is incorrect because the let statement syntax is correct in the query (assuming it follows standard KQL syntax).

Answer

The malicious IPs are not in the list.

Answer

The DeviceNetworkEvents table does not contain the RemoteIP column.

Answer

The let statement syntax is incorrect.

Question 10

You are hunting for signs of credential theft in Microsoft Defender XDR. Which advanced hunting table is most appropriate to investigate suspicious logon events?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents contains authentication logs, which are most relevant for investigating suspicious logon events and credential theft. Option A (DeviceNetworkEvents) is for network connections. Option B (DeviceProcessEvents) is for process events. Option C (EmailEvents) is for email records.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

EmailEvents

Question 11

Your threat hunt reveals a series of failed logon attempts from a single IP address across multiple user accounts. Which Microsoft Sentinel analytic rule template is best suited to alert on this brute-force pattern?

Accepted Answer

Brute force attack against a user account. The 'Brute force attack against a user account' rule specifically detects multiple failed logon attempts from a single IP address across multiple user accounts, matching the described pattern. Option A is for malware detection in network traffic. Option C is for password spray attacks, which involve a single password across many accounts. Option D is for anomalous logon locations based on geography.

Answer

Malware detected in network traffic

Answer

Password spray attack

Answer

Anomalous logon location

Question 12

You are threat hunting for signs of Kerberoasting in Microsoft Sentinel. Which combination of events indicates that a service account's Kerberos ticket was requested and then used?

Accepted Answer

Event ID 4769 (Kerberos Service Ticket Request) followed by Event ID 4624 (An account was logged on). Kerberoasting involves TGS requests (4769) followed by service logon (4624). Option B is for AS requests. Option C is for account lockout. Option D is for ticket renewal.

Answer

Event ID 4770 (Kerberos Ticket Renewal) followed by Event ID 4634 (Logoff)

Answer

Event ID 4740 (Account Lockout) followed by Event ID 4625 (Failed Logon)

Answer

Event ID 4768 (Kerberos Authentication Ticket) followed by Event ID 4776 (Credential Validation)

Question 13

You are using the Microsoft Sentinel Threat Hunting experience to create a new hunting query. Which tab should you select to bookmark a suspicious event for further investigation?

Accepted Answer

Bookmarks. The Bookmarks tab allows you to save and annotate suspicious events for further investigation. Option A (Results) displays query results but does not offer bookmarking. Option B (Queries) is for managing saved queries, not bookmarking events. Option D (Entities) shows entity pages, unrelated to bookmarking.

Answer

Results

Answer

Queries

Answer

Entities

Question 14

Your threat hunt identifies a process that is making outbound connections to an unknown IP address. Which Microsoft Defender for Endpoint action can you take to immediately isolate the device?

Accepted Answer

Isolate device. Isolate device disconnects the device from the network. Option B only runs a scan. Option C collects investigation package. Option D blocks the file but doesn't isolate.

Answer

Collect investigation package

Answer

Block file

Answer

Run antivirus scan

Question 15

You are reviewing a custom hunting query in Microsoft Sentinel. The query above returns results, but you suspect it misses low-frequency beaconing. Which modification improves detection while reducing false positives?

Accepted Answer

Use a sliding window to count distinct connection times per IP per device. A sliding window counts connections over time, detecting low-frequency beaconing that fixed windows might miss, while grouping by IP and device reduces false positives. Option C is incorrect because lowering the threshold increases false positives. Option B is incorrect because grouping only by DeviceName misses per-IP patterns. Option D is incorrect because adding RemotePort does not improve beaconing detection.

Answer

Group by DeviceName only

Answer

Decrease the count threshold to 10

Answer

Add RemotePort to the summarize clause