SC-200 Perform threat hunting Practice Test 16 — 15 Questions

Question 1

During a threat hunt, you identify a suspicious process execution chain in Microsoft Defender for Endpoint: `powershell.exe` spawned `cmd.exe` which then executed `rundll32.exe`. To investigate the parent-child relationships, which KQL statement should you use in Advanced Hunting?

Accepted Answer

DeviceProcessEvents | where ProcessChain has_all ("powershell.exe", "cmd.exe", "rundll32.exe"). The `make_list` function with `ProcessChain` parameter can construct the process chain, but the standard approach is to use `DeviceProcessEvents` and join on `InitiatingProcessFileName` and `FileName`. However, the correct answer involves using `scan` or `join`. Actually, the best practice is to use the `ProcessChain` column if available, or use `make_list`. Option C is the most direct.

Answer

DeviceProcessEvents | where FileName == "rundll32.exe" and InitiatingProcessFileName == "cmd.exe"

Answer

DeviceProcessEvents | summarize by ProcessChain

Answer

DeviceProcessEvents | where FileName == "powershell.exe" | join kind=inner DeviceProcessEvents on $left.DeviceId == $right.DeviceId

Question 2

You are reviewing a custom analytics rule in Microsoft Sentinel. The rule is enabled but you notice that no alerts have been generated even though there are many matching events. What is the most likely cause?

Accepted Answer

The triggerThreshold of 5 requires at least 5 matching events in each hour.. The rule suppresses alerts for 5 hours after an alert is generated. Since suppression is enabled (suppressionEnabled: true? Actually the value is false, but the duration is set. Wait, suppressionEnabled is false, so suppression is disabled. However, the queryFrequency and queryPeriod are both 1 hour, and triggerThreshold is 5. If there are many matching events, the threshold might not be met if events are spread out. But the exhibit shows suppressionEnabled: false, so suppression is not the issue. The most likely cause is that the rule has a triggerThreshold of 5, meaning it requires at least 5 events in the query period. If there are fewer than 5, no alert is generated.

Answer

The rule is not associated with a data connector.

Answer

The queryPeriod is too short to capture events.

Answer

The rule is suppressed due to suppressionDuration of 5 hours.

Question 3

You are investigating a detection in Microsoft Defender for Endpoint. The PowerShell output shows a threat with ID 2147723152. Which type of threat does this ID represent?

Accepted Answer

HackTool. Threat ID 2147723152 corresponds to a hacktool (specifically, a tool used for penetration testing), often detected as 'HackTool:MSIL/Mimikatz!dha'.

Answer

Ransomware

Answer

Worm

Answer

Trojan

Question 4

A threat hunter runs the above KQL query in Microsoft Defender Advanced Hunting. What is the primary purpose of this query?

Accepted Answer

Detect logon attempts from new IP addresses for existing users.. The query creates a baseline of known AccountUpn and RemoteIP pairs from the past 30 days (excluding last day), then selects new logon events from the last day where the AccountUpn exists in baseline but the RemoteIP is not in the paired IP for that user. This detects logons from new IPs for existing users.

Answer

Create a list of all unique logon events in the last day.

Answer

Identify users who have not logged in within the past 30 days.

Answer

Find all logon events from IPs that have never been seen before.

Question 5

As part of a threat hunt, you want to find instances where a user successfully authenticated to multiple applications within a short time using different IP addresses. Which Microsoft 365 Defender data source would be most appropriate?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents contains authentication events for cloud apps, with columns like Application, IP address, and Timestamp.

Answer

CloudAppEvents

Answer

DeviceLogonEvents

Answer

AlertInfo

Question 6

During a threat hunt, you suspect a user may have exfiltrated data via email. Which Microsoft 365 Defender advanced hunting table should you query to review email attachments and their file hashes?

Accepted Answer

EmailAttachmentInfo. EmailAttachmentInfo contains details about email attachments, including file name, size, and SHA256 hash.

Answer

EmailUrlInfo

Answer

EmailEvents

Answer

EmailPostDeliveryEvents

Question 7

You are hunting for lateral movement in your environment. In Microsoft Defender for Identity, which activity is a strong indicator of a potential pass-the-hash attack?

Accepted Answer

An NTLM authentication originating from a machine that is not the user's usual machine.. Pass-the-hash attacks involve an attacker using a hash to authenticate as another user. An NTLM authentication using a hash from a different machine indicates this.

Answer

A user logging on with a smart card.

Answer

A remote desktop connection from a non-admin workstation to a domain controller.

Answer

A service account logging on to multiple servers simultaneously.

Question 8

Which TWO KQL operators are commonly used in threat hunting to join tables based on a key?

Accepted Answer

lookup. Join and lookup are both used to combine tables based on keys. Union combines rows, summarize aggregates, extend adds columns.

Answer

extend

Answer

summarize

Answer

union

Question 9

Which THREE data sources in Microsoft Sentinel are most useful for threat hunting activities related to identity compromise?

Accepted Answer

SecurityEvent. SigninLogs (Azure AD), AuditLogs (Azure AD), and SecurityEvent (Windows) provide identity-related data. CommonSecurityLog is for network appliances, OfficeActivity for M365 workloads.

Answer

CommonSecurityLog

Answer

OfficeActivity

Question 10

Which THREE techniques are commonly used in threat hunting within Microsoft Defender XDR to detect privilege escalation?

Accepted Answer

Token manipulation. Token manipulation, process injection, and access token manipulation are common privilege escalation techniques. Data exfiltration is a goal, not technique; spearphishing is initial access.

Answer

Spearphishing attachment

Answer

Data exfiltration

Question 11

A threat hunter wants to identify all devices that have communicated with a known malicious IP address in the last 7 days. Which table in Microsoft Defender for Endpoint advanced hunting should be queried?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents records network connections, including destination IP addresses.

Answer

DeviceFileEvents

Answer

DeviceProcessEvents

Answer

DeviceRegistryEvents

Question 12

You are conducting a threat hunt to find evidence of credential dumping on Windows servers. Which event ID in Windows Security Event Log (SecurityEvent) is most indicative of LSASS process access?

Accepted Answer

4656 (Handle to an object requested). Event ID 4656 is generated when a handle to an object (like LSASS) is requested, often used in credential dumping.

Answer

4688 (Process creation)

Answer

4672 (Special privileges assigned)

Answer

4624 (Logon)

Question 13

During a threat hunt, you find a PowerShell script that decodes a base64-encoded command and executes it. Which MITRE ATT&CK technique is this behavior most associated with?

Accepted Answer

T1027 (Obfuscated Files or Information). Obfuscated Files or Information (T1027) includes encoding. PowerShell execution is also part of T1059.001, but the encoding aspect points to T1027.

Answer

T1059.001 (PowerShell)

Answer

T1055 (Process Injection)

Answer

T1003 (Credential Dumping)

Question 14

You are performing a threat hunt in Microsoft Sentinel. You want to identify devices that have been communicating with known malicious IP addresses. Which data source should you query?

Accepted Answer

CommonSecurityLog. Option A is correct because CommonSecurityLog contains network traffic logs from security appliances. Option B is for Windows events, not network. Option C is for DNS queries. Option D is for device events from Defender for Endpoint, but not IP communications.

Answer

SecurityEvent

Answer

DnsEvents

Answer

DeviceNetworkEvents

Question 15

During a threat hunt, you discover suspicious PowerShell commands executed on multiple workstations. Which KQL function in Microsoft Sentinel is most effective for aggregating similar commands to identify a pattern?

Accepted Answer

summarize. Option C is correct because summarize with make_list groups similar events. Option A is wrong because search is for raw text. Option B is wrong because project is for column selection. Option D is wrong because extend adds computed columns.

Answer

extend

Answer

search

Answer

project