SC-200 Perform threat hunting Practice Test 2 — 15 Questions

Question 1

During a threat hunt, you discover that a PowerShell script executed on multiple servers and established outbound connections to an external IP address. Which data source should you query in Microsoft Defender XDR to identify the specific command-line arguments used?

Accepted Answer

DeviceProcessEvents. Option C is correct because DeviceProcessEvents captures process creation events including command-line arguments. Option A (DeviceNetworkEvents) captures network connections but not command-line arguments. Option B (DeviceEvents) captures various events but not specifically process command lines. Option D (DeviceImageLoadEvents) captures DLL loads, not command lines.

Answer

DeviceEvents

Answer

DeviceImageLoadEvents

Answer

DeviceNetworkEvents

Question 2

Your threat hunt aims to detect possible Kerberoasting attacks. Which KQL query in Microsoft Sentinel would best identify service principal name (SPN) requests from unusual accounts?

Accepted Answer

let knownAccounts = dynamic(['svc_sql', 'svc_adfs']); SecurityEvent | where EventID == 4768 | where Account !in (knownAccounts) | summarize cnt=count() by Account, IpAddress | where cnt > 5. Option B is correct because it joins TGT requests (Kerberos TGS requests) with high count per account and filters out known service accounts. Option A misses the join with known accounts. Option C focuses on TGT renewal, not service tickets. Option D uses a different event ID (4769 is for TGS, not TGT).

Answer

SecurityEvent | where EventID == 4768 | summarize count() by Account | where count_ > 10

Answer

SecurityEvent | where EventID == 4769 | summarize count() by Account

Answer

SecurityEvent | where EventID == 4773 | summarize count() by Account

Question 3

You are threat hunting for signs of credential dumping via LSASS access. Which Advanced Hunting schema table in Microsoft Defender XDR should you primarily query to find processes that opened a handle to LSASS?

Accepted Answer

DeviceEvents. Option D is correct because DeviceEvents includes events like 'LsassAccessedByProcess' from the Microsoft Defender for Identity sensor. Option A (DeviceProcessEvents) records process creation, not handle open. Option B (DeviceNetworkEvents) is for network. Option C (DeviceRegistryEvents) is for registry.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 4

Your threat hunt involves correlating alerts from Microsoft Defender for Cloud Apps with Microsoft Defender for Endpoint. Which Microsoft Sentinel integration should you use to unify these alerts for hunting?

Accepted Answer

Microsoft Sentinel's unified analytics rules and incident creation. Option A is correct because Microsoft Sentinel provides built-in connectors and analytics rules to correlate alerts across Microsoft Defender XDR, including Defender for Cloud Apps and Defender for Endpoint. Option B (Microsoft Graph API) is programmatic but not a unified hunting experience. Option C (Azure Monitor Workbooks) visualizes but does not correlate. Option D (Power Automate) automates responses but not correlation.

Answer

Power Automate flows to merge alerts

Answer

Microsoft Graph API to pull alerts into a custom database

Answer

Azure Monitor Workbooks to display alerts side by side

Question 5

During a hunt, you find that a user account has logged in from an IP address associated with a known command-and-control (C2) server. The hunt also reveals that the same IP accessed a SharePoint site containing sensitive documents. Which Microsoft Purview feature should you use to investigate data exfiltration?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Option B is correct because Microsoft Purview Data Loss Prevention (DLP) policies and activity explorer can show if sensitive data was accessed or shared externally. Option A (Information Protection) labels data but does not track exfiltration. Option C (Audit Log) logs events but lacks context of sensitive data. Option D (Compliance Manager) is for assessments, not investigation.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Audit (Standard)

Question 6

You need to create a custom detection rule in Microsoft Sentinel that alerts when an anomalous number of failed logons occur from a single IP address within 5 minutes. Which KQL operator should you use to count failed logons per IP?

Accepted Answer

summarize. Option A is correct because 'summarize' is used to aggregate counts per key (IP). Option B (project) only selects columns. Option C (extend) adds calculated columns. Option D (where) filters rows.

Answer

project

Answer

where

Answer

extend

Question 7

Your threat hunt identifies that an attacker used a previously unknown malware variant to move laterally. Which Microsoft Defender XDR feature would you use to automatically block the file based on behavioral detection?

Accepted Answer

Attack Surface Reduction (ASR) rules. Option D is correct because Attack Surface Reduction (ASR) rules can block suspicious behavior. Option A (Custom file indicators) blocks based on known IOCs. Option B (Network Protection) blocks network connections. Option C (Web Protection) blocks web traffic.

Answer

Web Protection

Answer

Custom file indicators (IoC)

Answer

Network Protection

Question 8

You are investigating a potential DCSync attack. Which Advanced Hunting query in Microsoft Defender XDR would best detect a process making atypical directory replication requests?

Accepted Answer

DeviceEvents | where ActionType == 'DirectoryReplicationRequest'. Option C is correct because DeviceEvents captures 'DirectoryReplicationRequest' events from Microsoft Defender for Identity. Option A (IdentityLogonEvents) captures logons. Option B (IdentityDirectoryEvents) captures directory changes but not replication requests. Option D (DeviceProcessEvents) captures process creation.

Answer

IdentityDirectoryEvents | where ActionType == 'Replication'

Answer

DeviceProcessEvents | where FileName contains 'ntdsutil'

Answer

IdentityLogonEvents | where ActionType == 'DirectoryReplication'

Question 9

You are hunting for signs of pass-the-hash (PtH) attacks. Which Windows Security Event ID should you focus on to detect anomalous NTLM authentication using a hash?

Accepted Answer

4624 (Logon) with LogonType 3. Option A is correct because Event ID 4624 (successful logon) with LogonType 3 (network) can indicate PtH if paired with unusual source IP. Option B (4776) is for credential validation but not necessarily PtH. Option C (4648) is for explicit credentials. Option D (4672) is for special privileges.

Answer

4672 (Special Logon)

Answer

4648 (Explicit Credential)

Answer

4776 (Credential Validation)

Question 10

Which TWO data sources are most relevant for threat hunting for lateral movement using remote service creation (e.g., WMI, PsExec)?

Accepted Answer

DeviceNetworkEvents. Correct options: B and C. DeviceProcessEvents captures process creation on remote machines (e.g., services.exe, cmd.exe). DeviceNetworkEvents captures outbound connections to high ports on remote machines. Option A (DeviceFileEvents) captures file writes, not execution. Option D (DeviceRegistryEvents) captures registry changes. Option E (DeviceEvents) captures various events but is less specific for remote service creation.

Answer

DeviceRegistryEvents

Answer

DeviceEvents

Answer

DeviceFileEvents

Question 11

Which THREE techniques would you use in Microsoft Sentinel to hunt for data exfiltration over DNS?

Accepted Answer

Analyze DNS query logs for high volume or long subdomains. Correct options: A, B, D. DNS query analysis (A) identifies unusual domains. Correlating DNS with process creation (B) identifies which process made the query. Using ASIM DNS parsers (D) standardizes DNS logs. Option C (Network traffic logs) covers IP traffic but not DNS queries specifically. Option E (Email events) is unrelated.

Answer

Examine network traffic logs for large data transfers to known cloud storage IPs

Answer

Review email forwarding rules for external domains

Question 12

Which TWO built-in Microsoft Sentinel hunting queries are useful for detecting signs of compromised credentials?

Accepted Answer

Anomalous logon location. Correct options: B and C. Anomalous logon location (B) can indicate credential misuse. Brute force attempt (C) detects password guessing. Option A (Baseline) is not a specific query. Option D (New user) may be legitimate. Option E (Deleted) is not specific to compromise.

Answer

Baseline of user behavior

Answer

Deleted user account

Answer

New user account creation

Question 13

A security analyst is using Microsoft Sentinel to hunt for signs of Kerberos golden ticket attacks. Which KQL function is most appropriate to identify anomalous Kerberos service ticket requests?

Accepted Answer

find. The KQL function find() searches across multiple tables, which is useful for hunting in different logs. Option A (union) is for combining tables, not searching across them. Option C (search) is deprecated. Option D (evaluate) is for plugins. Option B is wrong because it doesn't target Kerberos logs directly.

Answer

evaluate

Answer

search

Answer

union

Question 14

During a threat hunt, you discover a suspicious PowerShell command that decoded a base64 string and executed a script. Which Microsoft Defender for Endpoint advanced hunting table should you query to find the decoded command line?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents stores process creation events including command lines. DeviceEvents stores raw events but not command lines. DeviceNetworkEvents is for network connections. IdentityLogonEvents is for logons. The correct table for command lines is DeviceProcessEvents.

Answer

IdentityLogonEvents

Answer

DeviceNetworkEvents

Answer

DeviceEvents

Question 15

A threat hunter wants to use Microsoft Sentinel's UEBA to identify anomalous behavior. Which data connector must be enabled to provide the necessary Azure Active Directory (now Microsoft Entra ID) sign-in logs for UEBA?

Accepted Answer

Microsoft Entra ID. UEBA requires sign-in logs. The Microsoft Entra ID connector provides sign-in logs. Option B is for audit logs only. Option C is for Windows security events. Option D is for Office 365. The correct answer is the Microsoft Entra ID connector.

Answer

Office 365

Answer

Microsoft Entra ID Audit

Answer

Windows Security Events via AMA