SC-200 Perform threat hunting Practice Test 18 — 15 Questions

Question 1

Which TWO of the following KQL operators are most useful when building hunting queries to detect anomalous activities over time?

Accepted Answer

summarize. Options B and D are correct. summarize with bin() is fundamental for time-series analysis to detect anomalies. make_list() is often used with summarize to aggregate events per time period for anomaly detection. Option A (where) filters rows but does not directly help with time-based detection. Option C (project) selects columns and is not relevant for anomaly detection over time. Option E (extend) creates new columns but does not directly aid in time-based anomaly detection.

Answer

where

Answer

project

Answer

extend

Question 2

Which THREE of the following are indicators of a potential pass-the-hash attack that a threat hunter should investigate in Microsoft Defender for Identity?

Accepted Answer

Multiple failed logon attempts followed by a successful logon from the same IP. Correct answers are B, C, and D. B: Multiple failed logon attempts followed by a successful logon from the same IP indicates credential reuse, often seen in pass-the-hash attacks. C: Anomalous NTLM authentication from a domain controller is suspicious because domain controllers typically do not initiate NTLM requests; this can indicate credential theft. D: Event ID 4624 with LogonType 9 (NewCredentials) is a known indicator of pass-the-hash, as it represents a credential being used with a different logon session. A is incorrect because TGS requests are related to Kerberos, not pass-the-hash. E is incorrect because high CPU usage is not specific to pass-the-hash and could be due to many other reasons.

Answer

High volume of TGS requests from a single user

Answer

Anomalous spike in CPU usage on domain controllers

Question 3

You are a security operations analyst for Contoso Ltd. The company uses Microsoft Sentinel as its SIEM and Microsoft Defender for Cloud Apps for SaaS security. You are tasked with threat hunting for potential data exfiltration via Microsoft SharePoint Online. You need to create a hunting query that identifies users who have downloaded an unusually high number of files from SharePoint within a short time window compared to their historical baseline. The query should be run in Microsoft Sentinel using the OfficeActivity table. Which of the following approaches should you take?

Accepted Answer

Query the OfficeActivity table, filter for Operation=='FileDownloaded', summarize by UserId and bin(TimeGenerated, 1h), then use a join with a historical baseline table to detect deviations. The correct approach because it directly uses the OfficeActivity table, which contains SharePoint file download events (Operation=='FileDownloaded'). By summarizing download counts per user per hour with `summarize` and `bin(TimeGenerated, 1h)`, and then joining with a historical baseline table (e.g., a precomputed table of average hourly downloads per user), you can detect deviations that indicate potential data exfiltration. Option A is incorrect because the HuntingBookmark table is used to store bookmarks during investigations, not for running analytics or querying raw events. Option B is incorrect because the CommonSecurityLog table typically contains logs from third-party security appliances, not SharePoint events. Option D is incorrect because the SecurityAlert table contains alerts generated by detection rules, not raw event data needed for baseline calculations.

Answer

Use the HuntingBookmark table to search for user activity

Answer

Query the CommonSecurityLog table for SharePoint events and look for high volumes of outbound traffic

Answer

Query the SecurityAlert table for alerts related to data exfiltration

Question 4

Your organization uses Microsoft Defender for Endpoint and Microsoft Sentinel. As part of a threat hunting exercise, you need to detect potential lateral movement using remote desktop protocol (RDP). You want to identify devices that have initiated multiple RDP connections to different internal IP addresses within a short time frame. Which hunting query should you use in Microsoft Sentinel's Log Analytics workspace?

Accepted Answer

DeviceNetworkEvents | where RemotePort == 3389 and ActionType == 'ConnectionSuccess' | summarize dcount(RemoteIP) by DeviceName. DeviceNetworkEvents records network connections, including RDP traffic on port 3389. Summarizing distinct RemoteIP addresses per DeviceName can detect a device connecting to multiple internal IPs in a short time, indicating potential lateral movement. Option A is incorrect because Syslog captures Linux syslog messages, not Windows RDP events. Option B is incorrect because DeviceProcessEvents logs process creation events (like mstsc.exe execution), not the actual network connections to multiple IPs. Option D is incorrect because IdentityLogonEvents records authentication attempts, not network-level connection details.

Answer

Syslog | where Facility == 'auth' and Message contains 'RDP' | summarize count() by HostName

Answer

DeviceProcessEvents | where ProcessCommandLine contains 'mstsc.exe' | summarize count() by DeviceName

Answer

IdentityLogonEvents | where LogonType == 'RemoteInteractive' | summarize dcount(IPAddress) by DeviceName

Question 5

You are a security analyst at Fabrikam. The company uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. During a threat hunt, you need to identify users who are accessing cloud applications from multiple geographic locations in a short time, which could indicate credential theft or token replay. You want to create a hunting query in Microsoft Sentinel using the CloudAppEvents table. Which approach should you take?

Accepted Answer

Query CloudAppEvents, summarize by AccountDisplayName and bin(TimeGenerated, 1h), then use dcount(CountryCode) > 1. CloudAppEvents contains detailed cloud application activity data, including location information (e.g., CountryCode or IPCountry). By summarizing on AccountDisplayName and binning TimeGenerated into 1-hour windows, you can group a user's activities within a short timeframe. Then, using dcount(CountryCode) > 1 filters for users accessing from multiple distinct countries within that window, which is a strong indicator of potential credential theft or token replay. Option A is incorrect because CommonSecurityLog is used for on-premises security devices like firewalls and VPNs, not for cloud app events. Option B is incorrect because OfficeActivity only covers Office 365 workloads, not all cloud applications monitored by Defender for Cloud Apps. Option C is incorrect because SecurityAlert contains pre-generated security alerts, not raw activity data needed to calculate distinct locations.

Answer

Query CommonSecurityLog for VPN connections

Answer

Query OfficeActivity for sign-in logs

Answer

Query SecurityAlert for location-related alerts

Question 6

You are a threat hunter at Northwind Traders. The organization uses Microsoft Defender for Identity (MDI) and Microsoft Sentinel. You suspect a golden ticket attack may have occurred in the domain. You need to create a hunting query in Microsoft Sentinel that leverages data from MDI to detect possible golden ticket usage. Which of the following queries or approaches is most appropriate?

Accepted Answer

Query SecurityAlert where AlertName contains 'Golden Ticket' or 'Suspicious Kerberos'. Golden ticket attacks often involve anomalous Kerberos service ticket requests that are not preceded by an authentication request. MDI generates alerts for such anomalies, which are stored in the SecurityAlert table. Option A is incorrect because DeviceProcessEvents is for endpoints, not authentication servers. Option C is incorrect because IdentityLogonEvents may contain logon events but not specifically golden ticket indicators. Option D is incorrect because CommonSecurityLog is for network devices.

Answer

Query DeviceProcessEvents for processes related to Kerberos

Answer

Query CommonSecurityLog for unusual DNS queries related to Kerberos

Answer

Query IdentityLogonEvents for failed Kerberos authentication

Question 7

Which TWO of the following are valid methods to initiate a threat hunting session in Microsoft Sentinel?

Accepted Answer

Start from a specific detection rule. Starting from a specific detection rule and using a predefined hunting query are both valid methods. Live mode is not a feature; custom analytics rules are for detection, not hunting; and watchlists are used for enrichment, not for initiating hunting.

Answer

Create a custom analytics rule

Answer

Import a watchlist as a hunting query

Answer

Enable live mode on a hunting query

Question 8

Which THREE actions are part of the threat hunting process in Microsoft Defender XDR?

Accepted Answer

Investigate entities found in the results. Formulating a hypothesis, querying advanced hunting, and investigating entities are core steps. Configuring automated responses is part of incident response, and setting retention policies is data management.

Answer

Configure automated response actions

Answer

Set data retention policies for hunting data

Question 9

You are a security analyst at a company using Microsoft Sentinel. You have been asked to perform a threat hunt to identify potential brute-force attacks against your on-premises Active Directory. The relevant data is ingested into Sentinel from Windows Event Logs (Event ID 4625) and Azure ATP (now Microsoft Defender for Identity). Your hunting query should focus on failed logon attempts with high frequency from the same source IP within a short time window. You need to write a KQL query that returns the top 10 source IPs with the most failed logon attempts in the last 24 hours. Which KQL query should you use?

Accepted Answer

SecurityEvent | where EventID == 4625 | summarize count() by IpAddress | top 10 by count_. Ly filters for EventID 4625 (failed logon) and summarizes by IpAddress, which is the correct field for source IP in SecurityEvent. Option B uses SourceIp, which is not a standard field. Option C filters for EventID 4624 (successful logon). Option D includes both successful and failed logons, which would skew results.

Answer

SecurityEvent | where EventID == 4625 | summarize count() by SourceIp | top 10 by count_

Answer

SecurityEvent | where EventID == 4624 | summarize count() by IpAddress | top 10 by count_

Answer

SecurityEvent | where EventID in (4624,4625) | summarize count() by IpAddress | top 10 by count_

Question 10

You are a threat hunter for an organization that uses Microsoft Defender XDR. You suspect that an attacker may be using PowerShell to perform reconnaissance on domain controllers. You need to write an advanced hunting query in Microsoft Defender XDR that returns PowerShell commands executed on domain controllers in the last 7 days that contain cmdlets related to Active Directory reconnaissance, such as Get-ADUser or Get-ADGroupMember. The query should also include the device name, account name, and command line. Which query should you use?

Accepted Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where DeviceName contains "DC" | where ProcessCommandLine has_any ("Get-ADUser","Get-ADGroupMember","Get-ADComputer") | project DeviceName, AccountName, ProcessCommandLine. Ly filters by DeviceName containing 'DC' (domain controllers) and ProcessCommandLine containing relevant AD reconnaissance cmdlets, including Get-ADComputer which was added. It also projects the required fields. Option A misses the domain controller filter. Option C does not filter for AD cmdlets. Option D uses the wrong table (DeviceNetworkEvents) and does not filter for AD cmdlets.

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where ProcessCommandLine has_any ("Get-ADUser","Get-ADGroupMember") | project DeviceName, AccountName, ProcessCommandLine

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where DeviceName contains "DC" | project DeviceName, AccountName, ProcessCommandLine

Answer

DeviceNetworkEvents | where Timestamp > ago(7d) | where DeviceName contains "DC" | project DeviceName, AccountName, RemoteIP

Question 11

You are a security analyst using Microsoft Sentinel. During a threat hunt, you need to identify potential data exfiltration via DNS tunneling. You have DNS query logs ingested from your DNS servers via Syslog. The log schema includes fields: TimeGenerated, QueryName, QueryType, ClientIP, ResponseIP. You want to find DNS queries that are unusually long (over 50 characters in the query name) and have a high count of unique responses, which may indicate tunneling. You need to write a KQL query that returns the top 10 client IPs with the most unique response IPs for queries with query name length > 50 in the last 24 hours. Which query should you use?

Accepted Answer

Syslog | where TimeGenerated > ago(24h) | extend QueryNameLength = strlen(QueryName) | where QueryNameLength > 50 | summarize dcount(ResponseIP) by ClientIP | top 10 by dcount_ResponseIP. Ly filters for long query names, summarizes distinct ResponseIPs per ClientIP, and orders by dcount. Option B counts all responses, not unique. Option C uses wrong field. Option D does not filter length.

Answer

Answer

Answer

Syslog | where TimeGenerated > ago(24h) | summarize dcount(ResponseIP) by ClientIP | top 10 by dcount_ResponseIP

Question 12

You are a security operations analyst at a company that uses Microsoft Defender for Cloud Apps (now part of Microsoft Defender XDR) and Microsoft Sentinel. During a threat hunt, you suspect that an attacker may be using a compromised user account to access sensitive data in SharePoint Online from an unusual location. You have Microsoft Defender for Cloud Apps logs integrated into Sentinel. The log schema includes fields: TimeGenerated, UserId, AppName, ActivityType, IPAddress, Location, ObjectId (the document ID). You need to write a KQL query that returns a list of users who accessed the same sensitive document (ObjectId == 'SensitiveDocument123') from more than 3 unique IP addresses in the last hour, which could indicate a distributed access pattern. Which KQL query should you use?

Accepted Answer

CloudAppEvents | where TimeGenerated > ago(1h) | where ObjectId == 'SensitiveDocument123' | summarize dcount(IPAddress) by UserId | where dcount_IPAddress > 3. Ly filters CloudAppEvents for the last hour and the specific sensitive document (ObjectId == 'SensitiveDocument123'), then summarizes the distinct count of IP addresses per user, filtering for users with more than 3 unique IPs. This identifies distributed access by a single user. Option B uses a 24-hour time range instead of 1 hour, which may include legitimate historical access and is not limited to the last hour. Option C does not filter for the specific document, so it returns users who accessed any document from many IPs. Option D uses count() to count the number of log entries per (UserId, IPAddress) and filters for groups with more than 3 entries, which does not count unique IPs per user and may return users with many repeated accesses from the same IP.

Answer

CloudAppEvents | where TimeGenerated > ago(24h) | where ObjectId == 'SensitiveDocument123' | summarize dcount(IPAddress) by UserId | where dcount_IPAddress > 3

Answer

CloudAppEvents | where TimeGenerated > ago(1h) | summarize dcount(IPAddress) by UserId | where dcount_IPAddress > 3

Answer

CloudAppEvents | where TimeGenerated > ago(1h) | where ObjectId == 'SensitiveDocument123' | summarize count() by UserId, IPAddress | where count_ > 3

Question 13

You are a threat hunter for a company that uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). You need to investigate a potential privilege escalation attack. You have collected process creation events from endpoints and want to identify instances where a process with low integrity level spawned a process with high integrity level. The DeviceProcessEvents table includes fields: DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessIntegrityLevel, ProcessFileName, ProcessIntegrityLevel. You need to write an advanced hunting query that returns the top 10 devices where this escalation occurred most frequently in the last 7 days. Which query should you use?

Accepted Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessIntegrityLevel == "Low" and ProcessIntegrityLevel == "High" | summarize count() by DeviceName | top 10 by count_. Ly filters for processes where InitiatingProcessIntegrityLevel is 'Low' and ProcessIntegrityLevel is 'High', which captures privilege escalation from low to high integrity. It then counts per device and returns the top 10. Option B uses 'Medium' which is not the escalation of interest. Option C compares any inequality, missing the specific low-to-high transition. Option D compares filenames, which does not indicate integrity level changes.

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessIntegrityLevel == "Medium" and ProcessIntegrityLevel == "High" | summarize count() by DeviceName | top 10 by count_

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessIntegrityLevel != ProcessIntegrityLevel | summarize count() by DeviceName | top 10 by count_

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessFileName != ProcessFileName | summarize count() by DeviceName | top 10 by count_

Question 14

You are a security analyst at a company that uses Microsoft Sentinel and Microsoft Defender for Identity (now part of Microsoft Defender XDR). During a threat hunt, you need to identify potential golden ticket attacks. You have Windows Security Events (Event ID 4672: Special Logon) and Kerberos service ticket events (Event ID 4769) ingested. A golden ticket attack often involves service ticket requests with unusual encryption types or ticket options. You want to find service ticket requests (4769) that have TicketOptions containing '0x40810000' (forwardable, renewable, canonicalize) and TicketEncryptionType == '0x17' (RC4), which are common in attacks. You need to write a KQL query that returns the top 10 accounts requesting such tickets in the last 7 days. Which query should you use?

Accepted Answer

SecurityEvent | where EventID == 4769 | where TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" | summarize count() by AccountName | top 10 by count_. It filters for Event ID 4769 (Kerberos service ticket requests), applies both conditions (TicketOptions '0x40810000' and TicketEncryptionType '0x17' using equality comparisons), summarizes the count by AccountName, and returns the top 10. Option A is missing the encryption type filter, allowing false positives. Option C uses event ID 4672 (Special Logon) instead of 4769. Option D uses `contains` which is less precise and may match unwanted substrings.

Answer

SecurityEvent | where EventID == 4769 | where TicketOptions == "0x40810000" | summarize count() by AccountName | top 10 by count_

Answer

SecurityEvent | where EventID == 4672 | where TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" | summarize count() by AccountName | top 10 by count_

Answer

SecurityEvent | where EventID == 4769 | where TicketOptions contains "0x40810000" and TicketEncryptionType contains "0x17" | summarize count() by AccountName | top 10 by count_

Question 15

A security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to detect when a user account has been used to log in from an unusual location and then immediately performs a password reset for another user. Which hunting approach is most effective for this scenario?

Accepted Answer

Write a KQL query that joins SigninLogs with AuditLogs on user principal name and times within a short window. (KQL query using join between two tables) is correct because it allows correlating login events from SigninLogs with password reset events from AuditLogs, combining the two conditions. Option A (playbook) is for automated response, not hunting. Option C (searching only SigninLogs) cannot correlate with password reset events. Option D (watchlist) provides static data, not real-time correlation.

Answer

Use a Microsoft Sentinel playbook to automatically flag any password reset

Answer

Search the SigninLogs table for logins from unusual locations

Answer

Create a watchlist of known unusual locations and use it in a query against AuditLogs