SC-200 Perform threat hunting Practice Test 17 — 15 Questions

Question 1

Which TWO KQL operators are most useful for threat hunting lateral movement in Microsoft Defender XDR? (Select two.)

Accepted Answer

join. Options C and E are correct. The join operator merges records from multiple tables (e.g., DeviceLogonEvents) to correlate lateral movement patterns, such as a user authenticating from multiple workstations. The where operator filters events based on conditions like remote logons or unusual protocols, essential for narrowing down lateral movement indicators. Option A (project) selects columns, not directly useful for lateral movement. Option B (summarize) aggregates data, which can help identify patterns but is not specific to correlation. Option D (search) performs text searches across tables, which is inefficient for structured KQL queries.

Answer

project

Answer

summarize

Answer

search

Question 2

Which THREE of the following are recommended practices for creating effective threat hunting queries in Microsoft Sentinel? (Select three.)

Accepted Answer

Include known indicators of compromise from threat feeds. Options C, D, and E are correct. C: Including known indicators of compromise from threat feeds helps focus the hunt on verified malicious activity. D: Mapping queries to MITRE ATT&CK techniques aligns with adversary behaviors and improves detection coverage. E: Limiting the query to a specific time range improves performance and relevance by reducing data scope. Option A (broad patterns) is not recommended because it can generate too many false positives and miss subtle signs. Option B (extensive wildcards) is not recommended because it can degrade query performance and reduce precision.

Answer

Use only broad patterns to avoid missing anything

Answer

Use wildcards extensively to capture variations

Question 3

Which TWO tables in Microsoft Defender XDR advanced hunting are most useful for detecting data exfiltration attempts? (Select two.)

Accepted Answer

DeviceNetworkEvents. Options B and C are correct. DeviceNetworkEvents shows outbound network connections, which can indicate data exfiltration to external IPs. CloudAppEvents logs activities in cloud applications, such as unusual downloads or sharing of sensitive data. A (DeviceProcessEvents) focuses on process execution, D (EmailEvents) on email activities, and E (DeviceInfo) on device metadata, none of which directly detect data exfiltration as effectively as network and cloud app events.

Answer

DeviceProcessEvents

Answer

EmailEvents

Answer

DeviceInfo

Question 4

Which THREE of the following are valid sources of threat intelligence that can be ingested into Microsoft Sentinel for threat hunting? (Select three.)

Accepted Answer

Microsoft Threat Intelligence feed. Options B, C, and D are correct. B: Microsoft Threat Intelligence feed provides curated threat indicators. C: TAXII server enables ingestion of STIX threat intelligence. D: Custom threat intelligence can be ingested via the Microsoft Sentinel API. Option A is incorrect because Syslog is a log collection protocol, not a threat intelligence source. Option E is incorrect because Azure Policy is used for governance and compliance, not threat intelligence.

Answer

Syslog from a firewall

Answer

Azure Policy

Question 5

Which TWO of the following are key indicators of a potential DCSync attack that a threat hunter should look for in Microsoft Sentinel? (Select two.)

Accepted Answer

Event ID 4662 with access mask for DS-Replication-Get-Changes. Options C and E are correct. Event ID 4662 with an access mask containing DS-Replication-Get-Changes (or DS-Replication-Get-Changes-All) indicates a directory replication request characteristic of DCSync. E is correct because directory replication requests from non-domain controller accounts are anomalous; only domain controllers should initiate such replication. Option A (failed logons) is not specific to DCSync; B (new admin account) could be part of broader privilege escalation but not a direct indicator; D (multiple Kerberos tickets) relates to other attacks like Kerberoasting or Golden Ticket.

Answer

Failed logon attempts from a single IP

Answer

A new user account created with domain admin privileges

Answer

Multiple Kerberos ticket requests from a single user

Question 6

You are a security analyst at Contoso. You manage a Microsoft Sentinel workspace with Microsoft Defender for Cloud Apps, Microsoft Defender for Endpoint, and Microsoft Entra ID (formerly Azure AD) data connectors. You are performing a proactive threat hunt for potential data exfiltration via external file sharing services like Dropbox and Google Drive. Your organization blocks these services on managed devices but users can access them from personal devices. You want to detect when users log in to these services from a corporate network using Microsoft Entra ID credentials. You have access to CloudAppEvents, AADSignInEventsBeta, and DeviceNetworkEvents tables in Microsoft Defender XDR advanced hunting. You need to create a hunting query that identifies sign-ins to external file sharing apps from corporate IP ranges. The query should also exclude sign-ins from known good service accounts. Which approach should you take?

Accepted Answer

Join AADSignInEventsBeta with CloudAppEvents on AccountUpn, filter for app categories containing 'file sharing', and where IPAddress is in the corporate range.. This query joins AADSignInEventsBeta with CloudAppEvents on the AccountUpn field, then filters for app categories containing 'file sharing' and where the IPAddress is within the corporate IP range. This directly identifies sign-ins to external file sharing apps from corporate IPs using Microsoft Entra ID credentials, and can exclude known good service accounts by adding a filter on the user or account name. Option A only uses network events without sign-in context, so it cannot determine if the user actually signed in with Entra ID credentials. Option B uses CloudAppEvents and filters by IP, but then joins with DeviceInfo for device ownership; this does not include the sign-in events, and it may miss personal devices not managed. Option D relies on high-volume traffic analysis, which is less precise and lacks the app-level context.

Answer

Use DeviceNetworkEvents to find connections to file sharing service IPs, then correlate with AADSignInEventsBeta by user.

Answer

Filter CloudAppEvents for app categories 'file sharing' and where IP is in corporate range, then join with DeviceInfo for device ownership.

Answer

Use DeviceNetworkEvents to find high-volume outbound traffic to cloud storage provider IP ranges, then manually investigate users.

Question 7

During a threat hunt, you identify a suspicious process that spawned from Microsoft Word with a command-line argument containing ' -enc '. Which hunting technique is most appropriate to investigate this further?

Accepted Answer

Decode the base64-encoded command-line argument. The '-enc' argument in the command line indicates a base64-encoded PowerShell command. Decoding this argument allows the hunter to immediately see the intended malicious action. Options A, B, and C may be relevant later but are not the most appropriate first step in this scenario.

Answer

Review the PowerShell script block logging

Answer

Initiate network traffic analysis for the host

Answer

Check the file hash against threat intelligence feeds

Question 8

You are threat hunting in Microsoft Defender XDR for signs of Kerberoasting. Which hunting query would be most effective in identifying Kerberoasting activity?

Accepted Answer

IdentityQueryEvents | where QueryTarget like 'TGS' | summarize count() by InitiatingAccount, IPAddress | where count_ > 10. Kerberoasting involves an attacker requesting Kerberos service tickets (TGS) for multiple services using a single account, which can be detected by querying IdentityQueryEvents for TGS queries and looking for high volumes from a single initiating account and IP address. Option A is incorrect because IdentityDirectoryEvents filtering on 'Service Accounts' identifies service accounts, not the attacker's anomalous TGS requests. Option C is incorrect because failed Kerberos logins are not specific to Kerberoasting; the attack exploits valid ticket requests. Option D is incorrect because failed logon events focus on authentication failures, not the successful TGS requests characteristic of Kerberoasting.

Answer

IdentityDirectoryEvents | where AccountDomain == 'Service Accounts'

Answer

IdentityLogonEvents | where Application == 'Kerberos' and Result == 'Failed'

Answer

IdentityLogonEvents | where LogonType == 'Failed'

Question 9

Refer to the exhibit. The KQL query is used in a threat hunting campaign. Which of the following best describes the hunting activity this query is designed to detect?

Accepted Answer

Macro-based PowerShell execution from Office documents. The query detects PowerShell launched from Microsoft Office applications, which is a common technique for macro-based attacks. Option B is incorrect because the query does not filter by encoded command. Option C is incorrect because it does not look for lateral movement. Option D is incorrect because there is no external IP or network connection in the query.

Answer

Encoded PowerShell commands executed from the command line

Answer

Lateral movement using PowerShell remoting

Answer

Data exfiltration via PowerShell over HTTP

Question 10

During a threat hunt, you notice an anomalous number of failed logon attempts from a single IP address across multiple user accounts in Microsoft Entra ID sign-in logs. What is the most effective next step to determine if this is a brute-force attack?

Accepted Answer

Correlate with successful logon events from the same IP for those accounts. Correlating failed logon attempts with successful logon events from the same IP address for the same accounts is the most effective next step. If a successful logon occurs shortly after failures, it strongly indicates a brute-force attack succeeded. This evidence justifies further action like blocking the IP or resetting the compromised account. Option A (blocking IP immediately) may be premature without confirming success. Option B (resetting all affected passwords) is disruptive and may not address the root cause if no breach occurred. Option C (disabling accounts) could block legitimate users unnecessarily.

Answer

Immediately block the IP address in the firewall

Answer

Reset passwords for all affected accounts

Answer

Disable the accounts that had failed logons

Question 11

You are threat hunting for indicators of compromise related to a known malware family. Which data source in Microsoft Defender XDR would provide the most direct evidence of malware execution on endpoints?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents captures process creation events, which directly indicate malware execution. Option A is incorrect because EmailEvents only covers email data, not execution events. Option C (DeviceNetworkEvents) shows network connections that may occur after execution, but does not directly show execution itself. Option D (IdentityLogonEvents) focuses on authentication events, not process execution.

Answer

EmailEvents

Answer

IdentityLogonEvents

Answer

DeviceNetworkEvents

Question 12

In a threat hunt, you discover that a non-admin user account created a scheduled task that executes a PowerShell script to connect to an external IP on port 4444. Which of the following is the most likely interpretation of this activity?

Accepted Answer

The scheduled task is likely a reverse shell for persistence and remote access. PowerShell connecting to an external IP on a non-standard port like 4444 is indicative of a reverse shell. Option A is incorrect because standard admin tasks typically use RDP or WinRM. Option B is incorrect because port 4444 is not typically used for updates. Option C is incorrect because remote assistance uses different ports and protocols.

Answer

The user is performing legitimate remote administration

Answer

The PowerShell script is a remote assistance tool

Answer

The scheduled task is part of a software update mechanism

Question 13

While threat hunting in Microsoft Sentinel, you want to create a hunting query that identifies all attempts to disable security controls. Which data table would be most appropriate to query for such activity?

Accepted Answer

SecurityEvent. (SecurityEvent) is correct because it contains Windows security events such as Event ID 4688 (process creation) and 4689 (process termination), which can show attempts to stop security services like antimalware or firewall. Option A (Syslog) is for Linux events. Option C (CommonSecurityLog) is for firewall logs. Option D (OfficeActivity) is for Office 365 audit logs.

Answer

Syslog

Answer

CommonSecurityLog

Answer

OfficeActivity

Question 14

Which TWO of the following are common techniques used by attackers to bypass security controls that a threat hunter should look for?

Accepted Answer

Process injection into trusted processes. Options A and E are correct. Process injection is a technique where attackers inject malicious code into legitimate processes to evade detection. DLL sideloading exploits the way applications load DLLs, allowing an attacker to place a malicious DLL in a location where it will be loaded instead of the legitimate one. Options B (Enabling multi-factor authentication), C (Regular software updates), and D (Enforcing strong password policies) are all security controls or best practices that help protect systems, not techniques used to bypass security controls.

Answer

Enabling multi-factor authentication

Answer

Regular software updates

Answer

Enforcing strong password policies

Question 15

Which THREE of the following are key components of a successful threat hunting program in a Microsoft Defender XDR environment?

Accepted Answer

Deep understanding of normal network behavior. Options A, B, and C are correct. A deep understanding of normal network behavior (A) is essential for identifying anomalies. A clear hypothesis based on threat intelligence (B) guides the hunt and focuses efforts. The MITRE ATT&CK framework (C) provides a structured taxonomy for mapping adversary techniques. Option D is incorrect because automated incident response playbooks are part of remediation, not the hunting process itself. Option E is incorrect because threat hunting is proactive, not reactive to alerts.

Answer

Automated incident response playbooks

Answer

Reactive response to alerts