SC-200 Perform threat hunting Practice Test 2 — 15 Questions

Question 1

Your threat hunt aims to detect possible Kerberoasting attacks. Which KQL query in Microsoft Sentinel would best identify service principal name (SPN) requests from unusual accounts?

Accepted Answer

let knownAccounts = dynamic(['svc_sql', 'svc_adfs']); SecurityEvent | where EventID == 4768 | where Account !in (knownAccounts) | summarize cnt=count() by Account, IpAddress | where cnt > 5. The best query for detecting Kerberoasting is Option C. Kerberoasting involves requesting Kerberos service tickets (TGS) for service principal names (SPNs) to crack the service account password. Event ID 4769 corresponds to a Kerberos service ticket request. Option C filters out known service accounts (like svc_sql, svc_adfs) and looks for accounts with more than 5 requests, which may indicate an attacker brute-forcing service tickets. Option A uses Event ID 4768 (TGT requests), which is not directly related to service ticket requests. Option B does not filter known accounts and includes all accounts. Option D uses Event ID 4773 (Kerberos service ticket renewal), which is not the typical event for Kerberoasting.

Answer

SecurityEvent | where EventID == 4768 | summarize count() by Account | where count_ > 10

Answer

SecurityEvent | where EventID == 4769 | summarize count() by Account

Answer

SecurityEvent | where EventID == 4773 | summarize count() by Account

Question 2

You are threat hunting for signs of credential dumping via LSASS access. Which Advanced Hunting schema table in Microsoft Defender XDR should you primarily query to find processes that opened a handle to LSASS?

Accepted Answer

DeviceEvents. (DeviceEvents) is correct because it includes events related to handle access, such as 'LsassAccessedByProcess' from the Microsoft Defender for Identity sensor. Option A (DeviceProcessEvents) records process creation events, not handle operations. Option C (DeviceNetworkEvents) captures network-related events. Option D (DeviceRegistryEvents) logs registry modifications, none of which cover LSASS handle access.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 3

Your threat hunt involves correlating alerts from Microsoft Defender for Cloud Apps with Microsoft Defender for Endpoint. Which Microsoft Sentinel integration should you use to unify these alerts for hunting?

Accepted Answer

Microsoft Sentinel's unified analytics rules and incident creation. Microsoft Sentinel provides built-in connectors and analytics rules to correlate alerts across Microsoft Defender XDR, including Defender for Cloud Apps and Defender for Endpoint. Option B (Power Automate) can automate workflows but does not provide a unified hunting experience or correlation. Option C (Microsoft Graph API) is programmatic and can retrieve alerts, but it is not a unified correlation tool. Option D (Azure Monitor Workbooks) visualizes data but does not correlate or unify alerts for hunting.

Answer

Power Automate flows to merge alerts

Answer

Microsoft Graph API to pull alerts into a custom database

Answer

Azure Monitor Workbooks to display alerts side by side

Question 4

During a hunt, you find that a user account has logged in from an IP address associated with a known command-and-control (C2) server. The hunt also reveals that the same IP accessed a SharePoint site containing sensitive documents. Which Microsoft Purview feature should you use to investigate data exfiltration?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct feature because it can monitor and detect when sensitive data is accessed or shared externally, such as when a user account from a C2 IP accesses a SharePoint site with sensitive documents. DLP policies can trigger alerts and provide detailed activity reports via the Activity Explorer, allowing security analysts to investigate potential data exfiltration. Option B (Information Protection) focuses on classifying and labeling sensitive data but does not track access or exfiltration events. Option C (Compliance Manager) is used for risk assessments and compliance posture, not for investigating specific incidents. Option D (Audit (Standard)) logs user activities but lacks the sensitivity context of DLP to identify exfiltration of sensitive data.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Audit (Standard)

Question 5

You need to create a custom detection rule in Microsoft Sentinel that alerts when an anomalous number of failed logons occur from a single IP address within 5 minutes. Which KQL operator should you use to count failed logons per IP?

Accepted Answer

summarize. 'summarize' is used to aggregate counts per key (IP). Option B (project) only selects columns. Option C (where) filters rows. Option D (extend) adds calculated columns.

Answer

project

Answer

where

Answer

extend

Question 6

Your threat hunt identifies that an attacker used a previously unknown malware variant to move laterally. Which Microsoft Defender XDR feature would you use to automatically block the file based on behavioral detection?

Accepted Answer

Attack Surface Reduction (ASR) rules. Attack Surface Reduction (ASR) rules can block suspicious behaviors based on file actions, even for unknown malware variants. Option A (Web Protection) controls web traffic but does not block files. Option B (Custom file indicators) requires known indicators of compromise (IOCs) and is not effective against unknown variants. Option C (Network Protection) monitors network connections but does not directly block file execution.

Answer

Web Protection

Answer

Custom file indicators (IoC)

Answer

Network Protection

Question 7

You are investigating a potential DCSync attack. Which Advanced Hunting query in Microsoft Defender XDR would best detect a process making atypical directory replication requests?

Accepted Answer

DeviceEvents | where ActionType == 'DirectoryReplicationRequest'. DeviceEvents captures 'DirectoryReplicationRequest' events from Microsoft Defender for Identity, which are indicative of DCSync attacks. Option A (IdentityDirectoryEvents) captures directory changes but not replication requests. Option B (DeviceProcessEvents) captures process creation, not replication requests. Option C (IdentityLogonEvents) captures logon events, not replication.

Answer

IdentityDirectoryEvents | where ActionType == 'Replication'

Answer

DeviceProcessEvents | where FileName contains 'ntdsutil'

Answer

IdentityLogonEvents | where ActionType == 'DirectoryReplication'

Question 8

You are hunting for signs of pass-the-hash (PtH) attacks. Which Windows Security Event ID should you focus on to detect anomalous NTLM authentication using a hash?

Accepted Answer

4624 (Logon) with LogonType 3. Event ID 4624 (Logon) with LogonType 3 (network) is the correct event to detect pass-the-hash because PtH involves network logons using NTLM hashes. Event ID 4672 (Special Logon) indicates assignment of special privileges but is not directly related to PtH. Event ID 4648 (Explicit Credential) is used when credentials are passed explicitly, not indicative of hash reuse. Event ID 4776 (Credential Validation) records attempts to validate credentials but does not specify the logon type or protocol used, making it less specific for PtH. Therefore, D is correct.

Answer

4672 (Special Logon)

Answer

4648 (Explicit Credential)

Answer

4776 (Credential Validation)

Question 9

Which TWO data sources are most relevant for threat hunting for lateral movement using remote service creation (e.g., WMI, PsExec)?

Accepted Answer

DeviceNetworkEvents. Correct options: C and E. DeviceProcessEvents captures process creation on remote machines (e.g., services.exe, cmd.exe) which is indicative of remote service creation via WMI or PsExec. DeviceNetworkEvents captures outbound network connections to high ports (e.g., 135, 445) on remote machines. Option A (DeviceRegistryEvents) captures registry modifications, not directly relevant. Option B (DeviceEvents) is less specific for this scenario. Option D (DeviceFileEvents) captures file writes, not process execution.

Answer

DeviceRegistryEvents

Answer

DeviceEvents

Answer

DeviceFileEvents

Question 10

Which THREE techniques would you use in Microsoft Sentinel to hunt for data exfiltration over DNS?

Accepted Answer

Analyze DNS query logs for high volume or long subdomains. Correct options: A, C, E. DNS query analysis (A) helps identify unusual domain patterns like long subdomains indicative of exfiltration. Correlating DNS with process creation (C) pinpoints the source process, aiding attribution. ASIM DNS parsers (E) normalize logs for advanced anomaly detection. Option B is incorrect because large data transfers to known cloud storage IPs are not specific to DNS exfiltration—DNS exfiltration typically uses small payloads in DNS queries. Option D is unrelated as email forwarding rules are about email, not DNS.

Answer

Examine network traffic logs for large data transfers to known cloud storage IPs

Answer

Review email forwarding rules for external domains

Question 11

Which TWO built-in Microsoft Sentinel hunting queries are useful for detecting signs of compromised credentials?

Accepted Answer

Anomalous logon location. Correct options: B and C. Anomalous logon location (B) can indicate credential misuse. Brute force attempt (C) detects password guessing. Option A (Baseline) is not a specific query. Option D (New user) may be legitimate. Option E (Deleted) is not specific to compromise.

Answer

Baseline of user behavior

Answer

Deleted user account

Answer

New user account creation

Question 12

A security analyst is using Microsoft Sentinel to hunt for signs of Kerberos golden ticket attacks. Which KQL function is most appropriate to identify anomalous Kerberos service ticket requests?

Accepted Answer

find. The KQL function find() searches across multiple tables, which is useful for hunting in different logs to identify anomalous Kerberos service ticket requests. Option B (evaluate) is for invoking plugins, not for searching across tables. Option C (search) is deprecated in favor of find(). Option D (union) combines rows from multiple tables but does not search for specific patterns or values.

Answer

evaluate

Answer

search

Answer

union

Question 13

During a threat hunt, you discover a suspicious PowerShell command that decoded a base64 string and executed a script. Which Microsoft Defender for Endpoint advanced hunting table should you query to find the decoded command line?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents stores process creation events including command lines. DeviceEvents stores raw events but not command lines. DeviceNetworkEvents is for network connections. IdentityLogonEvents is for logons. The correct table for command lines is DeviceProcessEvents.

Answer

IdentityLogonEvents

Answer

DeviceNetworkEvents

Answer

DeviceEvents

Question 14

A threat hunter wants to use Microsoft Sentinel's UEBA to identify anomalous behavior. Which data connector must be enabled to provide the necessary Azure Active Directory (now Microsoft Entra ID) sign-in logs for UEBA?

Accepted Answer

Microsoft Entra ID. UEBA in Microsoft Sentinel requires sign-in logs to detect anomalous behavior. The Microsoft Entra ID connector (option C) provides these sign-in logs from Azure AD/Entra ID. Option A (Office 365) provides Exchange, Teams, and SharePoint logs, but not sign-in logs. Option B (Microsoft Entra ID Audit) provides only audit logs, not sign-in events. Option D (Windows Security Events via AMA) provides security event logs from Windows machines, which do not contain cloud sign-in data. Therefore, the Microsoft Entra ID connector is the correct choice.

Answer

Office 365

Answer

Microsoft Entra ID Audit

Answer

Windows Security Events via AMA

Question 15

During a hunt, you find a device that made successive outbound connections to multiple IP addresses on port 445 (SMB) within a short time. Which type of activity does this pattern most likely indicate?

Accepted Answer

Lateral movement preparation. Port 445 is used for SMB. Rapid successive connections to many IPs on SMB suggests scanning for open SMB shares, often a precursor to lateral movement. Option A (data exfiltration) typically uses HTTP/HTTPS. Option C (C2 beaconing) uses common ports like 80/443. Option D (reconnaissance) is broad; the specific pattern points to lateral movement via SMB.

Answer

Data exfiltration

Answer

Command and control beaconing

Answer

Internal reconnaissance