SC-200 Perform threat hunting Practice Test 2 — 15 Questions

Question 1

A threat hunter suspects a data exfiltration attempt via DNS tunneling. Which KQL query would best detect unusual DNS query patterns in Microsoft Sentinel?

Accepted Answer

DnsEvents | summarize count() by ClientIP, Subdomain | where count_ > 100. To detect DNS tunneling, you need to look for a high volume of queries to many unique subdomains from a single client, which indicates potential data exfiltration. Option A uses `summarize count() by ClientIP, Subdomain` and filters where the count is greater than 100, directly identifying clients with a large number of queries to different subdomains—a classic sign of DNS tunneling. Option B filters on response size > 1000, which may indicate large payloads but is not the primary indicator of tunneling. Option C filters on non-zero result codes, which may indicate failures but not specifically tunneling. Option D filters on query type 'A', which is too broad and does not isolate tunneling patterns.

Answer

DnsEvents | where ResponseSize > 1000

Answer

DnsEvents | where ResultCode != 0

Answer

DnsEvents | where QueryType == 'A'

Question 2

Which TWO Microsoft Sentinel hunting features can be used to automatically surface suspicious activities without manual query writing?

Accepted Answer

Livestream. Livestream (C) is correct because it lets you run a saved hunting query continuously and raises an incident/alert when new matching events appear, so suspicious activity is surfaced automatically without writing new queries each time. Hunting queries (E) are correct because Microsoft Sentinel ships built-in, pre-written hunting queries that can be run (and scheduled) to proactively surface suspicious activity without the analyst authoring KQL from scratch. Workbooks (A) are only dashboards/visualization reports and do not detect or surface suspicious activity on their own. Analytics rules (B) do automate alerting, but they are the scheduled detection/incident-creation mechanism rather than a hunting feature, and the question asks specifically about hunting features. Playbooks (D) are SOAR automation workflows triggered by incidents/alerts, not a hunting capability for surfacing suspicious activity.

Answer

Workbooks

Answer

Analytics rules

Answer

Playbooks

Question 3

You are reviewing a hunting query that identifies accounts with failed logons followed by successful logons from the same IP. The query returns no results even though you suspect brute force activity. What is the most likely issue?

Accepted Answer

The join condition is too strict; the SourceIP might differ between failed and successful logons. The most likely issue is that the join condition is too strict — specifically, the query requires the SourceIP to match exactly between failed and successful logons. In real brute-force or password-spray activity, the attacker often rotates source IPs (via proxies, VPNs, or botnets), so the successful logon may come from a different IP than the failed attempts. Relaxing the join (e.g., joining on account only, or using a time-window correlation) would surface the activity.

Answer

The time range is too short

Answer

The threshold is too low

Answer

The EventID for successful logon is incorrect

Question 4

You are creating a custom hunting query in Microsoft Sentinel for PowerShell Empire indicators. After deploying, the query never returns results, even though you know empire activity exists in the environment. What is the most likely cause?

Accepted Answer

The query logic is flawed; it should group the conditions with parentheses. The query combines 'FileName contains 'powershell'' with 'ProcessCommandLine contains 'System.Net.WebClient'' and 'InitiatingProcessFileName contains 'powershell'' using OR and AND without parentheses. In KQL, AND has higher precedence than OR. Therefore, the query is evaluated as: (FileName contains 'powershell') OR (ProcessCommandLine contains '...' AND InitiatingProcessFileName contains '...'). This likely returns results that are not PowerShell Empire activity. To correctly identify PowerShell processes using WebClient, the conditions should be grouped: (FileName contains 'powershell' OR InitiatingProcessFileName contains 'powershell') AND ProcessCommandLine contains '...'. Option C is correct because the logic flaw is the missing parentheses. Option A (using 'and' instead of 'or') would make the query too restrictive. Option B (connector) is irrelevant; the query would work with the existing connector. Option D (changing 'contains' to 'startswith') would miss cases where the string appears mid-text.

Answer

The query should use 'and' instead of 'or'

Answer

The required data connector should be 'MicrosoftThreatProtection'

Answer

The 'contains' operator should be 'startswith'

Question 5

A threat hunter runs this KQL query to find devices making many outbound SMB connections. The result shows a device 'DC01' connecting to over 100 different IPs on port 445. What is the most likely explanation?

Accepted Answer

DC01 is performing normal domain operations like Group Policy distribution. A domain controller (DC01) making many outbound SMB connections to unique IPs is typical for normal activity such as Group Policy distribution and logon scripts. Option D correctly identifies this as normal domain operations. Option A (data exfiltration) is unlikely because SMB is not commonly used for exfiltration. Option B (network scanning) is possible but less likely for a DC under normal circumstances. Option C (malware spreading) is a concern but not the most probable explanation given the DC's role.

Answer

DC01 is exfiltrating data via SMB

Answer

DC01 is scanning the network for open SMB shares

Answer

DC01 is compromised and spreading malware

Question 6

Your threat hunting team is using Microsoft Sentinel with User and Entity Behavior Analytics (UEBA). You want to identify anomalous outbound data transfers that may indicate data exfiltration. Which KQL function should you use to compare current activity against a baseline?

Accepted Answer

series_decompose. There is no KQL function named 'behavioranalytics'. The BehaviorAnalytics table stores precomputed UEBA scores, but comparing a time series of activity against its baseline/trend to surface anomalies is done with the series_decompose (and series_decompose_anomalies) KQL functions, not a standalone 'behavioranalytics' function.

Answer

behavioranalytics

Answer

summarize

Answer

make-series

Question 7

You are creating a custom detection rule in Microsoft Sentinel using the JSON above. The rule does not trigger any alerts despite known PowerShell encoded commands executing. What is the most likely cause?

Accepted Answer

The filename 'powershell.exe' is case-sensitive and may not match actual events.. The query uses a case-sensitive match for 'powershell.exe', but actual events may use 'PowerShell.exe' or other casing, causing the rule not to trigger. Option A is incorrect because 'contains' is supported in custom detection rules. Option B is incorrect because time filters are optional and not required for the rule to trigger. Option C is incorrect because the JSON syntax is valid.

Answer

The query uses 'contains' which is not supported in custom detections.

Answer

The query is missing a time filter.

Answer

The JSON has a syntax error.

Question 8

Refer to the exhibit. The KQL query is used for threat hunting in Microsoft 365 Defender. What is the primary purpose of this query?

Accepted Answer

Identify periods of high scheduled task creation activity that may indicate lateral movement.. The KQL query aggregates scheduled task creation events into time buckets (e.g., using summarize by bin(TimeGenerated, 1h)) to surface spikes in activity. Because attackers commonly use schtasks.exe or the Task Scheduler service to establish persistence and move laterally, a sudden burst of task creation across hosts is a strong hunting signal. The query's purpose is anomaly detection via time-series aggregation, not enumeration or IOC matching.

Answer

List all scheduled tasks created in the last 7 days.

Answer

Correlate scheduled task creation with known threat actor techniques.

Answer

Calculate the baseline of scheduled task creation per hour.

Question 9

Refer to the exhibit. This JSON defines a scheduled analytics rule in Microsoft Sentinel. Which type of threat is the rule primarily designed to detect?

Accepted Answer

Script-based malware execution attempting C2 communication. The query is a fuzzy union of two independent conditions: (1) DeviceProcessEvents where a process named rundll32.exe was launched with 'javascript' in its command line -- a known LOLBin technique to execute JScript without a dropped script file -- and (2) DeviceNetworkEvents showing any outbound HTTP connection to a public IP. Because it is a union (not a join), the rule does not require these two events to be correlated by device or time; either one alone satisfies the query. This still points to script-based malware execution attempting C2-style behavior (via the rundll32/javascript LOLBin pattern) as the best-fit classification among the given options, but the explanation should not claim a correlated sequence or reference powershell.exe/cscript.exe/wscript.exe, which do not appear in the exhibit.

Answer

Lateral movement using remote desktop

Answer

Credential dumping via LSASS

Answer

Data exfiltration via DNS tunneling

Question 10

Refer to the exhibit. This KQL query is used for threat hunting in Microsoft Defender XDR. What is the primary goal of this query?

Accepted Answer

Find users with an unusually high number of successful logons compared to their own baseline.. The KQL query in the exhibit is designed to find users with an unusually high number of successful logons compared to their own baseline (C). This type of query typically uses summarize, bin, and anomaly detection functions (like series_decompose_anomalies or make-series) to compare each user's current logon count against their historical average. The goal is to detect compromised accounts or insider threats where a user suddenly logs in far more often than normal.

Answer

Detect brute force attacks by correlating multiple users from the same IP.

Answer

Identify logons from unusual geographic locations.

Answer

Identify users with failed logon attempts exceeding a threshold.

Question 11

You are threat hunting for signs of Microsoft 365 mailbox compromise. Which hunting query in Microsoft 365 Defender would be most effective for identifying suspicious mailbox forwarding rules?

Accepted Answer

EmailEvents | where EmailAction == 'Forward'. Mailbox forwarding rules are captured in the EmailEvents table. Option A correctly uses EmailEvents and filters for forwarding actions. Option B is incorrect because DeviceEvents is for device-related events, not mailbox events. Option C is incorrect because AlertInfo is for alert metadata, not raw events. Option D is incorrect because EmailPostDeliveryEvents is for post-delivery actions, not forwarding rules.

Answer

DeviceEvents | where ActionType contains 'Mailbox'

Answer

AlertInfo | where Title contains 'forward'

Answer

EmailPostDeliveryEvents | where Action == 'Forward'

Question 12

Refer to the exhibit. The KQL query is used for threat hunting in Microsoft Defender XDR. What is the most likely scenario this query is designed to detect?

Accepted Answer

Ransomware dropping executables on desktops and spreading via SMB. The KQL query in the exhibit correlates file creation events on user desktop paths with subsequent SMB network connections to remote hosts, which is the classic behavioral signature of ransomware. Ransomware typically drops executable payloads into user-accessible folders like Desktop or Documents and then propagates laterally via SMB (TCP 445) to encrypt shared resources. This combination of mass file drops plus SMB fan-out is what Defender XDR hunting queries target for ransomware detection.

Answer

Persistence mechanism via startup folder

Answer

Registry modification to disable security tools

Answer

Phishing campaign delivering .lnk files

Question 13

You are a SOC analyst using Microsoft Sentinel. You need to create a hunting query that searches for unusual outbound RDP connections from workstations. Which KQL operators or functions would be most essential for this query?

Accepted Answer

DeviceNetworkEvents and where LocalPort == 3389 and RemoteIPType == 'Public'. DeviceNetworkEvents logs network connections including remote port and remote IP type. Filtering RemotePort == 3389 and RemoteIPType == 'Public' effectively identifies outbound RDP connections initiated by the workstation to public IPs.

Answer

DeviceProcessEvents and where ProcessCommandLine contains 'mstsc'

Answer

DeviceLogonEvents and where LogonType == 'RemoteInteractive'

Answer

DeviceEvents and where ActionType contains 'RDP'

Question 14

An analyst is reviewing a series of alerts in Microsoft Defender XDR indicating potential lateral movement. Which KQL query in Microsoft Sentinel would best identify anomalous RDP connections to servers not typically accessed remotely?

Accepted Answer

DeviceNetworkEvents | where RemotePort == 3389 | summarize dcount(DestinationIP) by DeviceName | where dcount_DestinationIP > 5. DeviceNetworkEvents captures actual network connection telemetry including RemotePort, so filtering on RemotePort == 3389 isolates RDP traffic. Summarizing the distinct count of DestinationIP per DeviceName and filtering for more than 5 destinations surfaces hosts making unusually broad outbound RDP connections — a strong lateral-movement indicator. This behavioral aggregation (dcount by device) is what distinguishes anomalous RDP fan-out from normal admin activity.

Answer

DeviceProcessEvents | where ProcessCommandLine contains '3389'

Answer

DeviceRegistryEvents | where RegistryKey contains 'Remote Desktop'

Answer

DeviceLogonEvents | where LogonType == '10' | summarize dcount(DeviceName) by AccountName

Question 15

You are investigating a potential data exfiltration incident. You notice a user uploading large amounts of data to a cloud storage service that the organization has not approved. Which Microsoft Defender XHR feature would best help you hunt for similar patterns across all users?

Accepted Answer

Advanced hunting in Microsoft Defender XDR. You are investigating a potential data exfiltration incident. You notice a user uploading large amounts of data to a cloud storage service that the organization has not approved. Which Microsoft Defender XDR feature would best help you hunt for similar patterns across all users?

Answer

Custom detection rules in Microsoft Sentinel

Answer

Incident investigation graph in Microsoft Defender XDR

Answer

Automation rules in Microsoft Sentinel