SC-200 Perform threat hunting Practice Test 3 — 15 Questions

Question 1

During a hunt, you find a device that made successive outbound connections to multiple IP addresses on port 445 (SMB) within a short time. Which type of activity does this pattern most likely indicate?

Accepted Answer

Lateral movement preparation. Port 445 is used for SMB. Rapid successive connections to many IPs on SMB suggests scanning for open SMB shares, often a precursor to lateral movement. Option A (data exfiltration) typically uses HTTP/HTTPS. Option C (C2 beaconing) uses common ports like 80/443. Option D (reconnaissance) is broad; the specific pattern points to lateral movement via SMB.

Answer

Data exfiltration

Answer

Command and control beaconing

Answer

Internal reconnaissance

Question 2

You are hunting for signs of Pass-the-Hash attacks using Microsoft Defender for Identity. Which alert should you look for in Microsoft Defender XDR?

Accepted Answer

Suspected overpass-the-hash attack. Microsoft Defender for Identity has a specific alert for suspected overpass-the-hash (Pass-the-Hash). Option A is for brute force. Option B is for honeytoken activity. Option D is for privilege escalation. The correct alert is 'Suspected overpass-the-hash attack'.

Answer

Honeytoken activity

Answer

Privilege escalation

Answer

Suspected brute force attack

Question 3

To hunt for malicious PowerShell encoded commands, which columns in the DeviceProcessEvents table in Microsoft 365 Defender advanced hunting should you focus on?

Accepted Answer

ProcessCommandLine. The ProcessCommandLine column contains the full command line, including encoded commands. Option A (FileName) only shows the executable name. Option B (InitiatingProcessFileName) shows parent process. Option D (DeviceName) is the machine name. The correct column is ProcessCommandLine.

Answer

DeviceName

Answer

FileName

Answer

InitiatingProcessFileName

Question 4

A threat hunter suspects a data exfiltration attempt via DNS tunneling. Which KQL query would best detect unusual DNS query patterns in Microsoft Sentinel?

Accepted Answer

DnsEvents | summarize count() by ClientIP, Subdomain | where count_ > 100. To detect DNS tunneling, you need to look for high volume of queries to many unique domains or subdomains. Option A looks for large size (not typical for tunneling). Option B looks for failed queries. Option D is too broad. Option C (queries with many unique subdomains) is a classic sign of DNS tunneling.

Answer

DnsEvents | where ResponseSize > 1000

Answer

DnsEvents | where ResultCode != 0

Answer

DnsEvents | where QueryType == 'A'

Question 5

While hunting, you notice a user account has been created and then immediately added to the Domain Admins group. Which table in Microsoft 365 Defender should you query to find this event?

Accepted Answer

IdentityDirectoryEvents. IdentityDirectoryEvents captures directory service changes like group membership modifications. IdentityLogonEvents is for logons. IdentityQueryEvents is for LDAP queries. DeviceEvents is for system events. The correct table is IdentityDirectoryEvents.

Answer

IdentityQueryEvents

Answer

IdentityLogonEvents

Answer

DeviceEvents

Question 6

You are hunting for suspicious scheduled tasks that could be used for persistence. Which Microsoft 365 Defender advanced hunting table contains information about scheduled tasks?

Accepted Answer

DeviceEvents. DeviceEvents includes various system events, including scheduled task creation via EventID 4698. DeviceProcessEvents is for processes. DeviceNetworkEvents is for network. IdentityLogonEvents is for logons. The correct table is DeviceEvents.

Answer

IdentityLogonEvents

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Question 7

Which TWO data sources are essential for threat hunting in Microsoft Sentinel to detect lateral movement?

Accepted Answer

DeviceNetworkEvents (Microsoft Defender for Endpoint). SecurityEvent (Windows Event Logs) provides process creation and network events. DeviceNetworkEvents provides network connections. Option A is for identity only. Option D is for DNS. Option E is for web proxy. The correct options are B and C.

Answer

Microsoft Entra ID sign-in logs

Answer

CommonSecurityLog (Syslog)

Answer

DnsEvents

Question 8

Which THREE indicators are commonly associated with ransomware activity in Microsoft Sentinel threat hunting?

Accepted Answer

Network connections to known C2 infrastructure. Ransomware typically involves file encryption (mass file rename/extension changes), C2 communication (beaconing), and scheduled task creation for persistence. Option A (unusual DNS) is not typical. Option D (excessive logins) is more brute force. The correct options are B, C, and E.

Answer

Unusual DNS queries to known safe domains

Answer

Excessive failed logon attempts from a single IP

Question 9

Which TWO Microsoft Sentinel hunting features can be used to automatically surface suspicious activities without manual query writing?

Accepted Answer

Livestream. Hunting queries are pre-built queries that run on a schedule. Livestream allows real-time detection of specific events. Option C (Analytics rules) is for detection, not hunting. Option D (Workbooks) is visualization. Option E (Playbooks) is automation. The correct options are A and B.

Answer

Workbooks

Answer

Analytics rules

Answer

Playbooks

Question 10

You are reviewing a hunting query that identifies accounts with failed logons followed by successful logons from the same IP. The query returns no results even though you suspect brute force activity. What is the most likely issue?

Accepted Answer

The join condition is too strict; the SourceIP might differ between failed and successful logons. The join uses 'inner', which requires matching keys in both sides. If the IP is different for failed and successful logons (e.g., attacker changes IP), the join fails. Option A (time range) is unlikely. Option C (EventID) is correct. Option D (threshold) is not the issue. The correct answer is B.

Answer

The time range is too short

Answer

The threshold is too low

Answer

The EventID for successful logon is incorrect

Question 11

You are creating a custom hunting query in Microsoft Sentinel for PowerShell Empire indicators. After deploying, the query never returns results, even though you know empire activity exists in the environment. What is the most likely cause?

Accepted Answer

The query logic is flawed; it should group the conditions with parentheses. The query uses 'or' incorrectly; the condition 'ProcessCommandLine contains 'System.Net.WebClient'' is evaluated separately from the FileName condition, so it would match any process with WebClient, not just PowerShell. Option A: 'contains' is correct for substring. Option B: 'and' would make it too restrictive. Option C: The connector is fine. The correct answer is D: the logical operator precedence is wrong.

Answer

The query should use 'and' instead of 'or'

Answer

The required data connector should be 'MicrosoftThreatProtection'

Answer

The 'contains' operator should be 'startswith'

Question 12

A threat hunter runs this KQL query to find devices making many outbound SMB connections. The result shows a device 'DC01' connecting to over 100 different IPs on port 445. What is the most likely explanation?

Accepted Answer

DC01 is performing normal domain operations like Group Policy distribution. A domain controller (DC01) making many outbound SMB connections to unique IPs is typical for normal activity like Group Policy processing or logon scripts. Option A (malware) is possible but less likely given it's a DC. Option C (scanning) is possible but not most likely. Option D (data exfiltration) is unlikely. The correct answer is B: normal DC behavior.

Answer

DC01 is exfiltrating data via SMB

Answer

DC01 is scanning the network for open SMB shares

Answer

DC01 is compromised and spreading malware

Question 13

You are performing a threat hunt in Microsoft Sentinel and have a KQL query that returns a high number of false positives. You want to reduce the noise without missing real threats. Which approach should you take?

Accepted Answer

Write a KQL query that looks for uncommon process chains, such as wscript.exe launched from Microsoft Office.. Option B is correct because filtering on specific process names and parent processes in KQL narrows the results to likely malicious activity. Option A may miss legitimate processes. Option C increases false positives. Option D removes the time filter which is essential for hunting.

Answer

Add a filter to exclude all Microsoft signed processes.

Answer

Remove the time filter and run the query against all historical data.

Answer

Broaden the time range to capture more data.

Question 14

During a threat hunt in Microsoft Defender XDR, you notice repeated failed logon attempts from an IP address that belongs to a known anonymizer service. What is the first action you should take?

Accepted Answer

Initiate an investigation by reviewing the impacted user accounts and endpoints for signs of compromise.. Option C is correct because the first step is to investigate the affected accounts and endpoints to determine if any compromise occurred. Option A may alert on false positives. Option B blocks access but may break legitimate business. Option D is premature without investigation.

Answer

Block the IP address in Microsoft Defender for Cloud Apps.

Answer

Create an analytics rule in Microsoft Sentinel to alert on all anonymizer IP addresses.

Answer

Report the IP to the Microsoft Sentinel Threat Intelligence team.

Question 15

Your threat hunting team is using Microsoft Sentinel with User and Entity Behavior Analytics (UEBA). You want to identify anomalous outbound data transfers that may indicate data exfiltration. Which KQL function should you use to compare current activity against a baseline?

Accepted Answer

behavioranalytics. Option D is correct because the behavior analytics function in KQL is used to detect anomalies based on UEBA profiles. Option A is for summarization. Option B is for time series decomposition. Option C is for data summarization.

Answer

series_decompose

Answer

summarize

Answer

make-series