SC-200 Perform threat hunting Practice Test 17 — 15 Questions

Question 1

Which TWO data sources are commonly used in Microsoft Sentinel for threat hunting related to lateral movement? (Select TWO.)

Accepted Answer

SecurityEvent. SecurityEvent (B) is correct because it captures Windows Security event log data forwarded via AMA/Log Analytics, including logon events (4624, 4625), explicit credential use (4648), and special privilege assignment (4672) that are the primary telemetry for detecting lateral movement techniques like pass-the-hash and RDP pivoting. DeviceNetworkEvents (D) is correct because it comes from Microsoft Defender for Endpoint and records inbound/outbound network connections with process, IP, and port context, which is essential for spotting lateral movement such as SMB (445), WMI, PsExec, and remote service creation across hosts. SigninLogs (A) is not among the marked answers: it covers Entra ID authentication events and is more relevant to identity-based attacks and initial access than host-to-host lateral movement. OfficeActivity (C) tracks SharePoint, Exchange, and Teams user actions, which relate to data exfiltration or phishing rather than lateral movement across endpoints. AuditLogs (E) records Entra ID directory changes such as role assignments and app registrations, which support privilege escalation and persistence investigations, not lateral movement hunting.

Answer

SigninLogs

Answer

OfficeActivity

Answer

AuditLogs

Question 2

Which THREE techniques are commonly used in Microsoft Sentinel threat hunting to identify command and control (C2) communication? (Select THREE.)

Accepted Answer

Detecting DNS tunneling. Detecting DNS tunneling (B) is correct because attackers frequently encode C2 data inside DNS queries and responses, and Sentinel hunting queries can flag anomalies such as high-entropy subdomains, excessive TXT/NULL record requests, or unusually long query names in DNS events. Analyzing network beaconing patterns (C) is correct because C2 implants typically check in at regular intervals, so hunting for periodic, low-volume outbound connections (for example, consistent time deltas or repeated small byte counts to the same destination) helps reveal compromised hosts. Examining SSL/TLS certificate anomalies (D) is correct because malicious C2 infrastructure often uses self-signed, expired, mismatched, or otherwise suspicious certificates, and Sentinel can correlate certificate metadata from network logs to identify such traffic. Analyzing email headers for phishing (A) is not a C2 communication technique; it targets initial access via email, and identifying brute force attempts (E) addresses credential attacks rather than command-and-control traffic.

Answer

Analyzing email headers for phishing

Answer

Identifying brute force attempts

Question 3

Which THREE actions should a threat hunter take when using Microsoft Defender XDR advanced hunting to investigate a potential ransomware outbreak? (Select THREE.)

Accepted Answer

Check for service installation events that mimic system services.. Option A is correct because ransomware operators frequently install malicious services with names that mimic legitimate system services (for example, svchost-like or Windows Update-like names) to achieve persistence and evade detection, so hunting service installation events in DeviceEvents (ActionType == 'ServiceInstalled') surfaces this masquerading behavior. Option C is correct because scheduled tasks are a common ransomware persistence mechanism; hunting TaskScheduler events such as TaskCreated/TaskUpdated in DeviceEvents reveals malicious tasks that re-launch the encryptor or payload after reboot. Option D is correct because correlating ProcessCreate events with FileModified/FileCreated events (for example, a process spawning and then rapidly modifying or renaming many files with extensions like .locked) exposes the encryption behavior that is the hallmark of a ransomware outbreak. Option B does not belong because mailbox audit logs and email forwarding rules are relevant to business email compromise or phishing investigations, not to endpoint ransomware encryption activity in advanced hunting. Option E does not belong because password change events for service accounts relate to credential abuse or account takeover detection, which is not the primary evidence of an active ransomware outbreak on endpoints.

Answer

Review mailbox audit logs for email forwarding rules.

Answer

Review password change events for service accounts.

Question 4

A threat hunter wants to use Microsoft Defender for Cloud Apps to hunt for suspicious OAuth app permissions. Which activity type should the analyst investigate?

Accepted Answer

OAuth app granting permissions. Suspicious OAuth app permissions are directly indicated by the activity type 'OAuth app granting permissions'. Option A (Failed logon attempts) is incorrect because it relates to authentication failures, not OAuth permissions. Option B (File download from SharePoint) is incorrect because it concerns data access, not permission grants. Option C (Mailbox forwarding rule created) is incorrect because it involves email rules, not OAuth authorizations.

Answer

Failed logon attempts

Answer

File download from SharePoint

Answer

Mailbox forwarding rule created

Question 5

You are using Microsoft Defender for Cloud Apps to hunt for suspicious OAuth app permissions. Which activity type should you look for to detect a potentially malicious app that was granted high privileges by a user?

Accepted Answer

Consent to application. 'Consent to application' (Option A). This activity captures when a user grants OAuth permissions to an application, which is the key indicator of high-privilege app consent. Option B, 'Add service principal', relates to creating a service principal object in Microsoft Entra ID, not user consent. Option C, 'Update application', involves modifying an app's configuration, not consent. Option D, 'Add app role assignment grant', is about assigning an app role to a user or group, which is a separate permission grant that does not involve user consent directly.

Answer

Add service principal

Answer

Update application

Answer

Add app role assignment grant

Question 6

During a threat hunt, you identify a user account that has been logging in from multiple geographic regions within a short time. Which Microsoft Defender for Cloud Apps feature should you use to investigate this anomaly?

Accepted Answer

Activity log. The Activity log in Microsoft Defender for Cloud Apps provides detailed records of user activities, including login locations and times, making it ideal for investigating anomalies like logins from multiple geographic regions. Option A (Cloud Discovery) is used to identify shadow IT and cloud app usage, not user login anomalies. Option B (App permissions) focuses on permissions granted to OAuth apps, not user activity. Option C (File policy) is for monitoring and protecting files, not login events.

Answer

Cloud Discovery

Answer

App permissions

Answer

File policy

Question 7

You are investigating a potential data exfiltration using Microsoft Defender for Cloud Apps. You find that a user downloaded a large number of files from SharePoint Online to a personal device. Which anomaly detection policy type would have detected this?

Accepted Answer

Activity anomaly detection policy. Activity anomaly detection policies detect unusual download volumes. Option B is wrong because File anomaly policies focus on file types and metadata. Option C is wrong because Cloud Discovery anomaly policies focus on shadow IT. Option D is wrong because OAuth app anomaly policies focus on app permissions.

Answer

File anomaly detection policy

Answer

Cloud Discovery anomaly detection policy

Answer

OAuth app anomaly detection policy

Question 8

As a threat hunter, you want to use MITRE ATT&CK techniques to categorize detected behaviors. In Microsoft Sentinel, which feature allows you to map alerts to MITRE techniques automatically?

Accepted Answer

Analytics rules. Analytics rules in Microsoft Sentinel allow you to map alerts to MITRE ATT&CK techniques automatically. When creating or editing an analytics rule, you can select the relevant MITRE ATT&CK tactic and technique, which enriches the alert with threat intelligence context. Workbooks (Option D) are for visualization, not mapping. Playbooks (Option B) are for automated response. Watchlists (Option C) are for reference data. Therefore, Option A is correct.

Answer

Playbooks

Answer

Watchlists

Answer

Workbooks

Question 9

Which TWO are valid methods for performing threat hunting in Microsoft Sentinel? (Choose two.)

Accepted Answer

Using the Hunting blade with built-in queries. Option B is correct because the Hunting blade in Microsoft Sentinel provides built-in, pre-designed hunting queries (based on KQL) that analysts can run across Log Analytics workspaces to proactively search for suspicious activity, which is a core threat-hunting method. Option D is correct because Microsoft Sentinel supports Jupyter notebooks integrated with MSTICpy, a Python library that enables advanced, customizable threat-hunting workflows such as querying logs, enriching data with threat intelligence, and visualizing results. Option A is not a hunting method but an automated incident-response capability (playbooks built on Logic Apps). Option C is incorrect because the MITRE ATT&CK dashboard/page in Sentinel is used for coverage mapping and understanding detections, not as a primary threat-hunting technique. Option E is incorrect because watchlists are used to store reference data (e.g., IPs, users) for correlation and can drive analytics rules, but creating alerts from watchlists is detection engineering, not threat hunting.

Answer

Using playbooks to respond to incidents

Answer

Using the MITRE ATT&CK dashboard

Answer

Using watchlists to create alerts

Question 10

Which THREE are essential components of a threat hunting hypothesis in Microsoft Sentinel? (Choose three.)

Accepted Answer

Adversary goal or objective. A threat hunting hypothesis in Microsoft Sentinel must be structured around what the adversary is trying to achieve, so option A (Adversary goal or objective) is correct because it defines the behavior or intent being tested, such as credential theft or lateral movement, which guides the entire hunt. Option C (Data sources to query) is correct because a hypothesis is only actionable if it maps to concrete telemetry in Sentinel, such as SecurityEvent, Syslog, SigninLogs, or OfficeActivity tables queried via KQL, so the hunter knows where to look. Option E (Expected indicators of compromise (IOCs)) is correct because the hypothesis must specify the observable artifacts that would confirm or refute it, such as specific process names, IP addresses, hashes, or anomalous sign-in patterns, enabling validation of the hunt. Option B (Alert severity level) is not essential because severity is a triage attribute of analytics rules and incidents, not a defining element of a hunting hypothesis. Option D (Automated response plan) is not essential because automation and playbooks belong to incident response and SOAR workflows, whereas threat hunting is an investigative, hypothesis-driven activity that may not trigger automated actions.

Answer

Alert severity level

Answer

Automated response plan

Question 11

Your threat hunting hypothesis is that a user's credentials were used to sign in from two geographically distant locations within a short time. In Microsoft Defender for Cloud Apps, which log type would you query in Microsoft Sentinel to detect impossible travel?

Accepted Answer

SigninLogs. Impossible travel detection relies on analyzing sign-in events with their source IP geolocation and timestamps. In Microsoft Sentinel, Microsoft Entra ID (Entra ID) sign-in events are stored in the SigninLogs table, which contains fields like IPAddress, Location, and TimeGenerated needed to compute whether a user signed in from two distant locations within an implausible timeframe. Defender for Cloud Apps surfaces these as impossible travel alerts, but the underlying Sentinel query targets SigninLogs.

Answer

AuditLogs

Answer

CommonSecurityLog

Answer

OfficeActivity

Question 12

You are investigating a detection in Microsoft Defender for Endpoint. The PowerShell output shows a threat with ID 2147723152. Which type of threat does this ID represent?

Accepted Answer

HackTool. Threat ID 2147723152 corresponds to a hacktool (specifically, a tool used for penetration testing), often detected as 'HackTool:MSIL/Mimikatz!dha'.

Answer

Ransomware

Answer

Worm

Answer

Trojan

Question 13

As part of a threat hunt, you want to find instances where a user successfully authenticated to multiple applications within a short time using different IP addresses. Which Microsoft 365 Defender data source would be most appropriate?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents contains authentication events for cloud apps, with columns like Application, IP address, and Timestamp.

Answer

CloudAppEvents

Answer

DeviceLogonEvents

Answer

AlertInfo

Question 14

During a threat hunt, you suspect a user may have exfiltrated data via email. Which Microsoft 365 Defender advanced hunting table should you query to review email attachments and their file hashes?

Accepted Answer

EmailAttachmentInfo. EmailAttachmentInfo is the correct table because it specifically contains metadata about email attachments, including the SHA256 hash of each attached file, file name, file type, and size. This table is designed for scenarios where you need to investigate suspicious attachments, such as during a data exfiltration hunt. The other tables focus on URLs, general email events, or post-delivery actions, not attachment details.

Answer

EmailUrlInfo

Answer

EmailEvents

Answer

EmailPostDeliveryEvents

Question 15

You are hunting for lateral movement in your environment. In Microsoft Defender for Identity, which activity is a strong indicator of a potential pass-the-hash attack?

Accepted Answer

An NTLM authentication originating from a machine that is not the user's usual machine.. Pass-the-hash attacks involve using a captured NTLM hash to authenticate without knowing the plaintext password. In Defender for Identity, a strong indicator is NTLM authentication originating from a machine that is not the user's usual machine, because the attacker is moving laterally using the hash from a compromised host. This behavior is flagged as suspicious because it deviates from normal user logon patterns.

Answer

A user logging on with a smart card.

Answer

A remote desktop connection from a non-admin workstation to a domain controller.

Answer

A service account logging on to multiple servers simultaneously.