SC-200 Perform threat hunting Practice Test 19 — 15 Questions

Question 1

You are threat hunting for indicators of compromise related to a known malware family. Which data source in Microsoft Defender XDR would provide the most direct evidence of malware execution on endpoints?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents captures process creation events, which directly indicate malware execution. Option A is incorrect because EmailEvents only covers email data, not execution events. Option C (IdentityLogonEvents) focuses on authentication events, not process execution. Option D (DeviceNetworkEvents) shows network connections that may occur after execution, but does not directly show execution itself.

Answer

EmailEvents

Answer

IdentityLogonEvents

Answer

DeviceNetworkEvents

Question 2

In a threat hunt, you discover that a non-admin user account created a scheduled task that executes a PowerShell script to connect to an external IP on port 4444. Which of the following is the most likely interpretation of this activity?

Accepted Answer

The scheduled task is likely a reverse shell for persistence and remote access. A non-admin user creating a scheduled task that runs PowerShell to connect to an external IP on port 4444 is a textbook reverse shell pattern. Port 4444 is the default listener port for Metasploit's meterpreter payload, and scheduled tasks provide persistence across reboots. The combination of non-admin context, external IP, unusual port, and scheduled execution strongly indicates attacker persistence and command-and-control.

Answer

The user is performing legitimate remote administration

Answer

The PowerShell script is a remote assistance tool

Answer

The scheduled task is part of a software update mechanism

Question 3

While threat hunting in Microsoft Sentinel, you want to create a hunting query that identifies all attempts to disable security controls. Which data table would be most appropriate to query for such activity?

Accepted Answer

SecurityEvent. The SecurityEvent table in Microsoft Sentinel contains Windows security events forwarded from agents, including Event ID 4688 (process creation) and events related to disabling security controls such as Windows Defender or audit policies. Threat hunting queries for control-disabling activity typically target SecurityEvent because it captures native Windows security log data. Other tables cover different log sources and would not contain these Windows security events.

Answer

Syslog

Answer

CommonSecurityLog

Answer

OfficeActivity

Question 4

Which TWO of the following are common techniques used by attackers to bypass security controls that a threat hunter should look for?

Accepted Answer

Process injection into trusted processes. Process injection into trusted processes (A) is a classic defense-evasion technique where an attacker writes malicious code into the memory space of a legitimate, trusted process (e.g., via CreateRemoteThread, APC injection, or process hollowing), allowing the payload to inherit the host process's privileges and blend into normal activity, which is exactly the kind of control bypass a threat hunter should detect. DLL sideloading (E) is another common evasion method in which a legitimate executable loads a malicious DLL from an attacker-controlled location due to insecure search-order or path resolution, hijacking trusted execution flow without triggering obvious alerts. By contrast, enabling multi-factor authentication (B), applying regular software updates (C), and enforcing strong password policies (D) are defensive hardening measures that strengthen security controls rather than techniques used to bypass them, so they are not attacker evasion methods.

Answer

Enabling multi-factor authentication

Answer

Regular software updates

Answer

Enforcing strong password policies

Question 5

Which THREE of the following are key components of a successful threat hunting program in a Microsoft Defender XDR environment?

Accepted Answer

Deep understanding of normal network behavior. A successful threat hunting program in Microsoft Defender XDR requires a deep understanding of normal network behavior (A), because establishing a baseline of legitimate activity lets hunters spot anomalies across endpoint, identity, email, and cloud telemetry that automated detections may miss. A clear hypothesis based on threat intelligence (B) is essential, since threat hunting is hypothesis-driven rather than alert-driven; hunters use intel to form testable assumptions about adversary behavior and then query Defender XDR advanced hunting (KQL) to validate or refute them. The use of the MITRE ATT&CK framework (C) is also a key component, as it maps observed techniques and tactics to a common taxonomy, helping hunters prioritize coverage gaps and structure hunts around known adversary TTPs. Automated incident response playbooks (D) belong to SOAR/automated investigation and response, not threat hunting, and reactive response to alerts (E) is the opposite of proactive hunting, so neither is a core component of a threat hunting program.

Answer

Automated incident response playbooks

Answer

Reactive response to alerts

Question 6

Which THREE of the following are indicators of a potential pass-the-hash attack that a threat hunter should investigate in Microsoft Defender for Identity?

Accepted Answer

Multiple failed logon attempts followed by a successful logon from the same IP. Option B is correct because a burst of failed logons immediately followed by a success from the same source IP is a classic credential-stuffing/brute-force precursor that often precedes or accompanies pass-the-hash, where stolen NTLM hashes are replayed to authenticate. Option C is correct because pass-the-hash relies on NTLM authentication, and anomalous NTLM traffic originating from a domain controller (which should normally use Kerberos for domain auth) is a strong Defender for Identity signal of hash replay or lateral movement. Option D is correct because LogonType 9 (NewCredentials) with Event ID 4624 indicates a process is using explicit alternate credentials via NTLM, which is exactly how tools like Mimikatz or PsExec execute pass-the-hash with a stolen hash rather than a password. Option A is not correct because a high volume of TGS requests points to Kerberoasting or ticket-based attacks, not pass-the-hash, which uses NTLM rather than TGS tickets. Option E is not correct because CPU spikes on domain controllers are a generic performance/availability indicator and are not a specific behavioral signature of pass-the-hash in Defender for Identity.

Answer

High volume of TGS requests from a single user

Answer

Anomalous spike in CPU usage on domain controllers

Question 7

You are a security operations analyst for Contoso Ltd. The company uses Microsoft Sentinel as its SIEM and Microsoft Defender for Cloud Apps for SaaS security. You are tasked with threat hunting for potential data exfiltration via Microsoft SharePoint Online. You need to create a hunting query that identifies users who have downloaded an unusually high number of files from SharePoint within a short time window compared to their historical baseline. The query should be run in Microsoft Sentinel using the OfficeActivity table. Which of the following approaches should you take?

Accepted Answer

Query the OfficeActivity table, filter for Operation=='FileDownloaded', summarize by UserId and bin(TimeGenerated, 1h), then use a join with a historical baseline table to detect deviations. The OfficeActivity table in Microsoft Sentinel contains audit logs for Microsoft 365 services, including SharePoint Online. Filtering for Operation=='FileDownloaded' and summarizing by UserId and time bin allows you to count downloads per user per hour. Joining with a historical baseline table (e.g., created via a separate query or using the 'summarize' operator over a longer period) enables detection of anomalies compared to each user's normal behavior.

Answer

Use the HuntingBookmark table to search for user activity

Answer

Query the CommonSecurityLog table for SharePoint events and look for high volumes of outbound traffic

Answer

Query the SecurityAlert table for alerts related to data exfiltration

Question 8

Your organization uses Microsoft Defender for Endpoint and Microsoft Sentinel. As part of a threat hunting exercise, you need to detect potential lateral movement using remote desktop protocol (RDP). You want to identify devices that have initiated multiple RDP connections to different internal IP addresses within a short time frame. Which hunting query should you use in Microsoft Sentinel's Log Analytics workspace?

Accepted Answer

DeviceNetworkEvents | where RemotePort == 3389 and ActionType == 'ConnectionSuccess' | summarize dcount(RemoteIP) by DeviceName. DeviceNetworkEvents is the Microsoft Defender for Endpoint table that records network connection telemetry, including the RemotePort and ActionType fields. Filtering on RemotePort == 3389 (the RDP port) with ActionType == 'ConnectionSuccess' and then using dcount(RemoteIP) by DeviceName surfaces devices that successfully connected to many distinct internal IPs — the classic signature of RDP-based lateral movement. This is the query pattern Microsoft recommends in Sentinel hunting workbooks for detecting RDP fan-out behavior.

Answer

Syslog | where Facility == 'auth' and Message contains 'RDP' | summarize count() by HostName

Answer

DeviceProcessEvents | where ProcessCommandLine contains 'mstsc.exe' | summarize count() by DeviceName

Answer

IdentityLogonEvents | where LogonType == 'RemoteInteractive' | summarize dcount(IPAddress) by DeviceName

Question 9

You are a security analyst at Fabrikam. The company uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. During a threat hunt, you need to identify users who are accessing cloud applications from multiple geographic locations in a short time, which could indicate credential theft or token replay. You want to create a hunting query in Microsoft Sentinel using the CloudAppEvents table. Which approach should you take?

Accepted Answer

Query CloudAppEvents, summarize by AccountDisplayName and bin(TimeGenerated, 1h), then use dcount(CountryCode) > 1. The CloudAppEvents table in Microsoft Sentinel contains Microsoft Defender for Cloud Apps activity logs, including user sign-ins and access to cloud applications with geographic metadata such as CountryCode. Summarizing by AccountDisplayName and binning TimeGenerated into 1-hour windows, then filtering where dcount(CountryCode) > 1, directly detects the impossible-travel pattern described. This is the canonical KQL approach for multi-geo access hunting in Sentinel.

Answer

Query CommonSecurityLog for VPN connections

Answer

Query OfficeActivity for sign-in logs

Answer

Query SecurityAlert for location-related alerts

Question 10

You are a threat hunter at Northwind Traders. The organization uses Microsoft Defender for Identity (MDI) and Microsoft Sentinel. You suspect a golden ticket attack may have occurred in the domain. You need to create a hunting query in Microsoft Sentinel that leverages data from MDI to detect possible golden ticket usage. Which of the following queries or approaches is most appropriate?

Accepted Answer

Query SecurityAlert where AlertName contains 'Golden Ticket' or 'Suspicious Kerberos'. Microsoft Defender for Identity (MDI) generates security alerts for suspicious Kerberos activity, including golden ticket attacks, which are surfaced in Microsoft Sentinel via the SecurityAlert table. Querying SecurityAlert for AlertName containing 'Golden Ticket' or 'Suspicious Kerberos' directly leverages MDI's built-in detections. This is the most appropriate approach because MDI already analyzes domain controller traffic and creates high-fidelity alerts.

Answer

Query DeviceProcessEvents for processes related to Kerberos

Answer

Query CommonSecurityLog for unusual DNS queries related to Kerberos

Answer

Query IdentityLogonEvents for failed Kerberos authentication

Question 11

Which TWO of the following are valid methods to initiate a threat hunting session in Microsoft Sentinel?

Accepted Answer

Start from a specific detection rule. Starting from a specific detection rule and using a predefined hunting query are both valid methods. Live mode is not a feature; custom analytics rules are for detection, not hunting; and watchlists are used for enrichment, not for initiating hunting.

Answer

Create a custom analytics rule

Answer

Import a watchlist as a hunting query

Answer

Enable live mode on a hunting query

Question 12

Which THREE actions are part of the threat hunting process in Microsoft Defender XDR?

Accepted Answer

Investigate entities found in the results. Threat hunting in Microsoft Defender XDR follows a hypothesis-driven, iterative process, and option D ("Formulate a hypothesis based on threat intelligence") is correct because a hunt begins by defining a specific, testable hypothesis derived from threat intel, known TTPs, or an anomaly to guide the search. Option C ("Query advanced hunting using KQL") is correct because the hypothesis is tested by running KQL queries in Advanced Hunting against tables such as DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents to surface matching telemetry. Option B ("Investigate entities found in the results") is correct because any suspicious processes, devices, IPs, or accounts returned by the query are then pivoted on and investigated (e.g., via the entity page, timeline, and incident correlation) to confirm or refute the hypothesis. Option A ("Configure automated response actions") is not part of hunting itself; automated response is configured through automated investigation and response (AIR) and custom detection/action settings, which are remediation, not hunting. Option E ("Set data retention policies for hunting data") is not part of the hunting process; retention is governed by tenant/Advanced Hunting data retention settings and is an administrative configuration rather than a hunting step.

Answer

Configure automated response actions

Answer

Set data retention policies for hunting data

Question 13

You are a threat hunter for a company that uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). You need to investigate a potential privilege escalation attack. You have collected process creation events from endpoints and want to identify instances where a process with low integrity level spawned a process with high integrity level. The DeviceProcessEvents table includes fields: DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessIntegrityLevel, ProcessFileName, ProcessIntegrityLevel. You need to write an advanced hunting query that returns the top 10 devices where this escalation occurred most frequently in the last 7 days. Which query should you use?

Accepted Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessIntegrityLevel == "Low" and ProcessIntegrityLevel == "High" | summarize count() by DeviceName | top 10 by count_. The query must filter for a genuine privilege escalation, which in Windows integrity-level terms means a low-integrity process spawning a high-integrity process. Option A correctly compares InitiatingProcessIntegrityLevel == "Low" against ProcessIntegrityLevel == "High", then aggregates by DeviceName and uses top 10 by count_ to surface the devices with the most escalation events in the last 7 days. This matches the stated requirement exactly.

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessIntegrityLevel == "Medium" and ProcessIntegrityLevel == "High" | summarize count() by DeviceName | top 10 by count_

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessIntegrityLevel != ProcessIntegrityLevel | summarize count() by DeviceName | top 10 by count_

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessFileName != ProcessFileName | summarize count() by DeviceName | top 10 by count_

Question 14

You are a security analyst at a company that uses Microsoft Sentinel and Microsoft Defender for Identity (now part of Microsoft Defender XDR). During a threat hunt, you need to identify potential golden ticket attacks. You have Windows Security Events (Event ID 4672: Special Logon) and Kerberos service ticket events (Event ID 4769) ingested. A golden ticket attack often involves service ticket requests with unusual encryption types or ticket options. You want to find service ticket requests (4769) that have TicketOptions containing '0x40810000' (forwardable, renewable, canonicalize) and TicketEncryptionType == '0x17' (RC4), which are common in attacks. You need to write a KQL query that returns the top 10 accounts requesting such tickets in the last 7 days. Which query should you use?

Accepted Answer

SecurityEvent | where EventID == 4769 | where TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" | summarize count() by AccountName | top 10 by count_. The correct query filters SecurityEvent for EventID 4769 (Kerberos service ticket request), then applies exact-match conditions on TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" to identify RC4-encrypted, forwardable/renewable/canonicalize tickets typical of golden ticket attacks. It then summarizes counts by AccountName and returns the top 10, matching the requirement precisely.

Answer

SecurityEvent | where EventID == 4769 | where TicketOptions == "0x40810000" | summarize count() by AccountName | top 10 by count_

Answer

SecurityEvent | where EventID == 4672 | where TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" | summarize count() by AccountName | top 10 by count_

Answer

SecurityEvent | where EventID == 4769 | where TicketOptions contains "0x40810000" and TicketEncryptionType contains "0x17" | summarize count() by AccountName | top 10 by count_

Question 15

You are a threat hunter in Microsoft Sentinel. You suspect an attacker is using the Windows utility certutil.exe to download malicious payloads from an external URL. You want to write a hunting query that detects command lines where certutil.exe is used with the -urlcache or -verifyctl arguments. Which KQL query should you use?

Accepted Answer

DeviceProcessEvents | where FileName == "certutil.exe" | where ProcessCommandLine has_any ("-urlcache", "-verifyctl"). The correct query uses DeviceProcessEvents to capture process creation events and filters for certutil.exe with the suspicious arguments -urlcache or -verifyctl. This directly matches the hunting hypothesis. Other tables either lack command-line data or use incorrect fields. DeviceProcessEvents is the authoritative source for process command lines in Microsoft Defender XDR, making it the right choice for detecting this living-off-the-land binary abuse.

Answer

DeviceNetworkEvents | where InitiatingProcessFileName == "certutil.exe" | where RemoteUrl contains "http"

Answer

DeviceEvents | where ActionType == "CertUtilDownload" | where AdditionalFields contains "urlcache"

Answer

DeviceFileEvents | where FileName == "certutil.exe" | where FolderPath contains "urlcache"