SC-200 Perform threat hunting Practice Test 18 — 15 Questions

Question 1

Refer to the exhibit. The KQL query is used in a threat hunting campaign. Which of the following best describes the hunting activity this query is designed to detect?

Accepted Answer

Macro-based PowerShell execution from Office documents. Option A is correct because the query detects PowerShell launched from Microsoft Office applications, which is a common technique for macro-based attacks. Option B is incorrect because the query does not filter by encoded command. Option C is incorrect because it does not look for lateral movement. Option D is incorrect because there is no external IP or network connection in the query.

Answer

Encoded PowerShell commands executed from the command line

Answer

Lateral movement using PowerShell remoting

Answer

Data exfiltration via PowerShell over HTTP

Question 2

During a threat hunt, you notice an anomalous number of failed logon attempts from a single IP address across multiple user accounts in Microsoft Entra ID sign-in logs. What is the most effective next step to determine if this is a brute-force attack?

Accepted Answer

Correlate with successful logon events from the same IP for those accounts. Option B is correct because correlating failed logons with successful ones from the same IP helps confirm if the attacker eventually succeeded. Option A is incorrect as blocking prematurely may not be justified. Option C is incorrect as resetting passwords does not address the source. Option D is incorrect as disabling accounts may impact legitimate users.

Answer

Immediately block the IP address in the firewall

Answer

Reset passwords for all affected accounts

Answer

Disable the accounts that had failed logons

Question 3

You are threat hunting for indicators of compromise related to a known malware family. Which data source in Microsoft Defender XDR would provide the most direct evidence of malware execution on endpoints?

Accepted Answer

DeviceProcessEvents. Option C is correct because DeviceProcessEvents captures process creation events, which directly indicate malware execution. Option A is incorrect because EmailEvents only covers email, not execution. Option B is incorrect because DeviceNetworkEvents shows network connections after execution. Option D is incorrect because IdentityLogonEvents focuses on authentication.

Answer

EmailEvents

Answer

IdentityLogonEvents

Answer

DeviceNetworkEvents

Question 4

In a threat hunt, you discover that a non-admin user account created a scheduled task that executes a PowerShell script to connect to an external IP on port 4444. Which of the following is the most likely interpretation of this activity?

Accepted Answer

The scheduled task is likely a reverse shell for persistence and remote access. Option D is correct because PowerShell connecting to an external IP on a non-standard port like 4444 is indicative of a reverse shell. Option A is incorrect because standard admin tasks typically use RDP or WinRM. Option B is incorrect because port 4444 is not typically used for updates. Option C is incorrect because remote assistance uses different ports and protocols.

Answer

The user is performing legitimate remote administration

Answer

The PowerShell script is a remote assistance tool

Answer

The scheduled task is part of a software update mechanism

Question 5

While threat hunting in Microsoft Sentinel, you want to create a hunting query that identifies all attempts to disable security controls. Which data table would be most appropriate to query for such activity?

Accepted Answer

SecurityEvent. Option A is correct because SecurityEvents (Windows Event Logs) contain events like 4688 (process creation) and 4689 (process termination) which can show attempts to stop security services. Option B is incorrect because CommonSecurityLog is for firewall logs. Option C is incorrect because Syslog is for Linux events. Option D is incorrect because OfficeActivity is for Office 365.

Answer

Syslog

Answer

CommonSecurityLog

Answer

OfficeActivity

Question 6

Which TWO of the following are common techniques used by attackers to bypass security controls that a threat hunter should look for?

Accepted Answer

Process injection into trusted processes. Options A and D are correct. Process injection is a classic technique to hide malicious code within legitimate processes. DLL sideloading exploits legitimate application load order to run malicious DLLs. Option B is incorrect because strong passwords are a defense, not an attack technique. Option C is incorrect because MFA is a security control, not a bypass. Option E is incorrect because software updates are mitigation, not an attack.

Answer

Enabling multi-factor authentication

Answer

Regular software updates

Answer

Enforcing strong password policies

Question 7

Which THREE of the following are key components of a successful threat hunting program in a Microsoft Defender XDR environment?

Accepted Answer

Deep understanding of normal network behavior. Options A, B, and E are correct. A success hypothesis guides the hunt. Deep knowledge of the environment helps identify anomalies. The MITRE ATT&CK framework provides a structured approach. Option C is incorrect because threat hunting is proactive, not reactive to alerts. Option D is incorrect because threat hunting is a skill distinct from incident response, though related.

Answer

Automated incident response playbooks

Answer

Reactive response to alerts

Question 8

Which TWO of the following KQL operators are most useful when building hunting queries to detect anomalous activities over time?

Accepted Answer

summarize. Options A and C are correct. summarize with bin() is fundamental for time-series analysis to detect anomalies. make_list() is often used with summarize to aggregate events per time period for anomaly detection. Option B is incorrect because extend creates new columns but does not directly help with time-based detection. Option D is incorrect because where filters rows but does not detect anomalies over time. Option E is incorrect because project selects columns.

Answer

where

Answer

project

Answer

extend

Question 9

Which THREE of the following are indicators of a potential pass-the-hash attack that a threat hunter should investigate in Microsoft Defender for Identity?

Accepted Answer

Multiple failed logon attempts followed by a successful logon from the same IP. Options A, B, and C are correct. Anomalous NTLM authentication from a domain controller is suspicious because DCs typically do not initiate NTLM requests. Multiple failed logon attempts followed by a success from the same IP indicates credential reuse. Event ID 4624 with logon type 9 (NewCredentials) often indicates pass-the-hash. Option D is incorrect because TGS requests are related to Kerberos, not pass-the-hash. Option E is incorrect because high resource usage is not specific to pass-the-hash.

Answer

High volume of TGS requests from a single user

Answer

Anomalous spike in CPU usage on domain controllers

Question 10

You are a security operations analyst for Contoso Ltd. The company uses Microsoft Sentinel as its SIEM and Microsoft Defender for Cloud Apps for SaaS security. You are tasked with threat hunting for potential data exfiltration via Microsoft SharePoint Online. You need to create a hunting query that identifies users who have downloaded an unusually high number of files from SharePoint within a short time window compared to their historical baseline. The query should be run in Microsoft Sentinel using the OfficeActivity table. Which of the following approaches should you take?

Accepted Answer

Query the OfficeActivity table, filter for Operation=='FileDownloaded', summarize by UserId and bin(TimeGenerated, 1h), then use a join with a historical baseline table to detect deviations. Option A is correct because using the OfficeActivity table with summarize and bin() allows you to count download events (Operation=='FileDownloaded') per user per hour and then compare the current count to a historical average to detect anomalies. Option B is incorrect because the CommonSecurityLog table does not contain SharePoint download events. Option C is incorrect because the HuntingBookmark table is for storing bookmarks, not for running analytics. Option D is incorrect because the SecurityAlert table contains alerts, not raw events needed for baseline calculation.

Answer

Use the HuntingBookmark table to search for user activity

Answer

Query the CommonSecurityLog table for SharePoint events and look for high volumes of outbound traffic

Answer

Query the SecurityAlert table for alerts related to data exfiltration

Question 11

Your organization uses Microsoft Defender for Endpoint and Microsoft Sentinel. As part of a threat hunting exercise, you need to detect potential lateral movement using remote desktop protocol (RDP). You want to identify devices that have initiated multiple RDP connections to different internal IP addresses within a short time frame. Which hunting query should you use in Microsoft Sentinel's Log Analytics workspace?

Accepted Answer

DeviceNetworkEvents | where RemotePort == 3389 and ActionType == 'ConnectionSuccess' | summarize dcount(RemoteIP) by DeviceName. Option C is correct because DeviceNetworkEvents contains network connections including RDP (destination port 3389). Summarizing by DeviceName and destination IP, then counting distinct destinations, can identify devices connecting to multiple internal IPs. Option A is incorrect because DeviceProcessEvents does not include network connections. Option B is incorrect because IdentityLogonEvents focuses on authentication, not network connections. Option D is incorrect because Syslog is for Linux systems, not Windows RDP connections.

Answer

Syslog | where Facility == 'auth' and Message contains 'RDP' | summarize count() by HostName

Answer

DeviceProcessEvents | where ProcessCommandLine contains 'mstsc.exe' | summarize count() by DeviceName

Answer

IdentityLogonEvents | where LogonType == 'RemoteInteractive' | summarize dcount(IPAddress) by DeviceName

Question 12

You are a security analyst at Fabrikam. The company uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. During a threat hunt, you need to identify users who are accessing cloud applications from multiple geographic locations in a short time, which could indicate credential theft or token replay. You want to create a hunting query in Microsoft Sentinel using the CloudAppEvents table. Which approach should you take?

Accepted Answer

Query CloudAppEvents, summarize by AccountDisplayName and bin(TimeGenerated, 1h), then use dcount(CountryCode) > 1. Option A is correct because CloudAppEvents contains location data (CountryCode or IPLocation). By summarizing per user and bin by time, you can group activities by user and time window, then filter for those with multiple distinct countries. Option B is incorrect because SecurityAlert contains alerts, not raw events. Option C is incorrect because OfficeActivity only covers Office 365, not all cloud apps. Option D is incorrect because CommonSecurityLog is for on-premises network devices, not cloud apps.

Answer

Query CommonSecurityLog for VPN connections

Answer

Query OfficeActivity for sign-in logs

Answer

Query SecurityAlert for location-related alerts

Question 13

You are a threat hunter at Northwind Traders. The organization uses Microsoft Defender for Identity (MDI) and Microsoft Sentinel. You suspect a golden ticket attack may have occurred in the domain. You need to create a hunting query in Microsoft Sentinel that leverages data from MDI to detect possible golden ticket usage. Which of the following queries or approaches is most appropriate?

Accepted Answer

Query SecurityAlert where AlertName contains 'Golden Ticket' or 'Suspicious Kerberos'. Option B is correct because golden ticket attacks often involve anomalous Kerberos service ticket requests that are not preceded by an authentication request. MDI generates alerts for such anomalies, which are stored in the SecurityAlert table. Option A is incorrect because DeviceProcessEvents is for endpoints, not authentication servers. Option C is incorrect because IdentityLogonEvents may contain logon events but not specifically golden ticket indicators. Option D is incorrect because CommonSecurityLog is for network devices.

Answer

Query DeviceProcessEvents for processes related to Kerberos

Answer

Query CommonSecurityLog for unusual DNS queries related to Kerberos

Answer

Query IdentityLogonEvents for failed Kerberos authentication

Question 14

Which TWO of the following are valid methods to initiate a threat hunting session in Microsoft Sentinel?

Accepted Answer

Start from a specific detection rule. Starting from a specific detection rule and using a predefined hunting query are both valid methods. Live mode is not a feature; custom analytics rules are for detection, not hunting; and watchlists are used for enrichment, not for initiating hunting.

Answer

Create a custom analytics rule

Answer

Import a watchlist as a hunting query

Answer

Enable live mode on a hunting query

Question 15

Which THREE actions are part of the threat hunting process in Microsoft Defender XDR?

Accepted Answer

Investigate entities found in the results. Formulating a hypothesis, querying advanced hunting, and investigating entities are core steps. Configuring automated responses is part of incident response, and setting retention policies is data management.

Answer

Configure automated response actions

Answer

Set data retention policies for hunting data

SC-200 Perform threat hunting Practice Test 18 — 15 Questions

Exhibit

SC-200 Perform threat hunting Practice Test 18 — 15 Questions

Exhibit