SC-200 Perform threat hunting Practice Test 17 — 15 Questions

Question 1

You run the KQL query above in Microsoft Sentinel. The query returns zero results even though you know some devices have connected to malicious IPs. What is the most likely cause?

Accepted Answer

The externaldata source URL is inaccessible from the Sentinel workspace.. Option A is correct because externaldata requires the cluster to access the URL, which may be blocked. Option B is wrong because the syntax is correct. Option C is wrong because DeviceNetworkEvents is valid. Option D is wrong because the IPs are in the list.

Answer

The malicious IPs are not in the list.

Answer

The DeviceNetworkEvents table does not contain the RemoteIP column.

Answer

The let statement syntax is incorrect.

Question 2

You are hunting for signs of credential theft in Microsoft Defender XDR. Which advanced hunting table is most appropriate to investigate suspicious logon events?

Accepted Answer

IdentityLogonEvents. Option B is correct because IdentityLogonEvents contains authentication logs. Option A is for email. Option C is for process events. Option D is for network events.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

EmailEvents

Question 3

Your threat hunt reveals a series of failed logon attempts from a single IP address across multiple user accounts. Which Microsoft Sentinel analytic rule template is best suited to alert on this brute-force pattern?

Accepted Answer

Brute force attack against a user account. Option D is correct because the 'Brute force attack against a user account' rule specifically detects multiple failed logons. Option A is for malware. Option B is for anomalous logons by geo. Option C is for password spray across users.

Answer

Malware detected in network traffic

Answer

Password spray attack

Answer

Anomalous logon location

Question 4

You are threat hunting for signs of Kerberoasting in Microsoft Sentinel. Which combination of events indicates that a service account's Kerberos ticket was requested and then used?

Accepted Answer

Event ID 4769 (Kerberos Service Ticket Request) followed by Event ID 4624 (An account was logged on). Option A is correct because Kerberoasting involves TGS requests (4769) followed by service logon (4624). Option B is for AS requests. Option C is for account lockout. Option D is for ticket renewal.

Answer

Event ID 4770 (Kerberos Ticket Renewal) followed by Event ID 4634 (Logoff)

Answer

Event ID 4740 (Account Lockout) followed by Event ID 4625 (Failed Logon)

Answer

Event ID 4768 (Kerberos Authentication Ticket) followed by Event ID 4776 (Credential Validation)

Question 5

You are using the Microsoft Sentinel Threat Hunting experience to create a new hunting query. Which tab should you select to bookmark a suspicious event for further investigation?

Accepted Answer

Bookmarks. Option B is correct because the Bookmarks tab allows you to save and annotate events. Option A is for query results. Option C is for saved queries. Option D is for entity pages.

Answer

Results

Answer

Queries

Answer

Entities

Question 6

Your threat hunt identifies a process that is making outbound connections to an unknown IP address. Which Microsoft Defender for Endpoint action can you take to immediately isolate the device?

Accepted Answer

Isolate device. Option A is correct because Isolate device disconnects the device from the network. Option B only runs a scan. Option C collects investigation package. Option D blocks the file but doesn't isolate.

Answer

Collect investigation package

Answer

Block file

Answer

Run antivirus scan

Question 7

You are reviewing a custom hunting query in Microsoft Sentinel. The query above returns results, but you suspect it misses low-frequency beaconing. Which modification improves detection while reducing false positives?

Accepted Answer

Use a sliding window to count distinct connection times per IP per device. Option C is correct because time-bounded connections better detect regular beaconing. Option A increases false positives. Option B only adds columns. Option D counts per device, missing cross-device patterns.

Answer

Group by DeviceName only

Answer

Decrease the count threshold to 10

Answer

Add RemotePort to the summarize clause

Question 8

Which TWO KQL operators are most useful for threat hunting lateral movement in Microsoft Defender XDR? (Select two.)

Accepted Answer

join. Options B and C are correct. join correlates events across devices, and where filters by remote logons. Option A is for text search, D is for aggregation, E is for column selection.

Answer

project

Answer

summarize

Answer

search

Question 9

Which THREE of the following are recommended practices for creating effective threat hunting queries in Microsoft Sentinel? (Select three.)

Accepted Answer

Include known indicators of compromise from threat feeds. Options A, B, and E are correct. A: use time constraints for performance. B: use external threat intelligence. E: use MITRE ATT&CK mapping. C is wrong because broad patterns miss subtle signs. D is wrong because wildcards strain performance.

Answer

Use only broad patterns to avoid missing anything

Answer

Use wildcards extensively to capture variations

Question 10

Which TWO tables in Microsoft Defender XDR advanced hunting are most useful for detecting data exfiltration attempts? (Select two.)

Accepted Answer

DeviceNetworkEvents. Options A and C are correct. DeviceNetworkEvents shows outbound connections; CloudAppEvents shows cloud app activity. B is for device info, D is for emails, E is for process events.

Answer

DeviceProcessEvents

Answer

EmailEvents

Answer

DeviceInfo

Question 11

Which THREE of the following are valid sources of threat intelligence that can be ingested into Microsoft Sentinel for threat hunting? (Select three.)

Accepted Answer

Microsoft Threat Intelligence feed. Options A, C, and D are correct. A: Microsoft Threat Intelligence feed. C: TAXII server for STIX indicators. D: Custom threat intelligence via API. B is wrong because Syslog is for log collection. E is wrong because Azure Policy is for compliance.

Answer

Syslog from a firewall

Answer

Azure Policy

Question 12

Which TWO of the following are key indicators of a potential DCSync attack that a threat hunter should look for in Microsoft Sentinel? (Select two.)

Accepted Answer

Event ID 4662 with access mask for DS-Replication-Get-Changes. Options A and D are correct. A: Replication from a non-DC indicates DCSync. D: Event 4662 with DS-Replication-Get-Changes is characteristic. B is for Kerberos. C is for account creation. E is for logon failure.

Answer

Failed logon attempts from a single IP

Answer

A new user account created with domain admin privileges

Answer

Multiple Kerberos ticket requests from a single user

Question 13

You are a security analyst at Contoso. You manage a Microsoft Sentinel workspace with Microsoft Defender for Cloud Apps, Microsoft Defender for Endpoint, and Microsoft Entra ID (formerly Azure AD) data connectors. You are performing a proactive threat hunt for potential data exfiltration via external file sharing services like Dropbox and Google Drive. Your organization blocks these services on managed devices but users can access them from personal devices. You want to detect when users log in to these services from a corporate network using Microsoft Entra ID credentials. You have access to CloudAppEvents, AADSignInEventsBeta, and DeviceNetworkEvents tables in Microsoft Defender XDR advanced hunting. You need to create a hunting query that identifies sign-ins to external file sharing apps from corporate IP ranges. The query should also exclude sign-ins from known good service accounts. Which approach should you take?

Accepted Answer

Join AADSignInEventsBeta with CloudAppEvents on AccountUpn, filter for app categories containing 'file sharing', and where IPAddress is in the corporate range.. Option B is correct because it joins sign-in events with cloud app events on user principal name and filters by app category (file sharing) and corporate IPs, which directly identifies the behavior. Option A only looks at network events, missing the sign-in context. Option C uses device info, which may not capture personal devices. Option D uses endpoint network events, missing the app context.

Answer

Use DeviceNetworkEvents to find connections to file sharing service IPs, then correlate with AADSignInEventsBeta by user.

Answer

Filter CloudAppEvents for app categories 'file sharing' and where IP is in corporate range, then join with DeviceInfo for device ownership.

Answer

Use DeviceNetworkEvents to find high-volume outbound traffic to cloud storage provider IP ranges, then manually investigate users.

Question 14

During a threat hunt, you identify a suspicious process that spawned from Microsoft Word with a command-line argument containing ' -enc '. Which hunting technique is most appropriate to investigate this further?

Accepted Answer

Decode the base64-encoded command-line argument. Option B is correct because base64-encoded command lines are commonly used in malicious documents to obfuscate payloads. Decoding the argument reveals the intended command. Option A is incorrect because decoding is not limited to PowerShell. Option C is incorrect because network traffic analysis may follow but is not the immediate next step. Option D is incorrect because file hash lookup is less relevant for the encoded command.

Answer

Review the PowerShell script block logging

Answer

Initiate network traffic analysis for the host

Answer

Check the file hash against threat intelligence feeds

Question 15

You are threat hunting in Microsoft Defender XDR for signs of Kerberoasting. Which hunting query would be most effective in identifying Kerberoasting activity?

Accepted Answer

IdentityQueryEvents | where QueryTarget like 'TGS' | summarize count() by InitiatingAccount, IPAddress | where count_ > 10. Option C is correct because Kerberoasting typically involves anomalous requests for Kerberos service tickets (TGS) by a single user to many services. Option A is incorrect because failed logins are not specific to Kerberoasting. Option B is incorrect because it focuses on service accounts, not the attacker's activity. Option D is incorrect because ticket decryption failures are not the primary indicator.

Answer

IdentityDirectoryEvents | where AccountDomain == 'Service Accounts'

Answer

IdentityLogonEvents | where Application == 'Kerberos' and Result == 'Failed'

Answer

IdentityLogonEvents | where LogonType == 'Failed'

SC-200 Perform threat hunting Practice Test 17 — 15 Questions

Exhibit

SC-200 Perform threat hunting Practice Test 17 — 15 Questions

Exhibit