SC-200 Perform threat hunting Practice Test 3 — 15 Questions

Question 1

You are hunting for signs of Pass-the-Hash attacks using Microsoft Defender for Identity. Which alert should you look for in Microsoft Defender XDR?

Accepted Answer

Suspected overpass-the-hash attack. Microsoft Defender for Identity has a specific alert for suspected overpass-the-hash (Pass-the-Hash) attacks. Option A is for honeytoken activity. Option B is for privilege escalation. Option C is for suspected brute force attack. The correct alert is 'Suspected overpass-the-hash attack'.

Answer

Honeytoken activity

Answer

Privilege escalation

Answer

Suspected brute force attack

Question 2

To hunt for malicious PowerShell encoded commands, which columns in the DeviceProcessEvents table in Microsoft 365 Defender advanced hunting should you focus on?

Accepted Answer

ProcessCommandLine. The ProcessCommandLine column contains the full command line, including encoded commands. Option A (FileName) only shows the executable name. Option B (InitiatingProcessFileName) shows parent process. Option D (DeviceName) is the machine name. The correct column is ProcessCommandLine.

Answer

DeviceName

Answer

FileName

Answer

InitiatingProcessFileName

Question 3

A threat hunter suspects a data exfiltration attempt via DNS tunneling. Which KQL query would best detect unusual DNS query patterns in Microsoft Sentinel?

Accepted Answer

DnsEvents | summarize count() by ClientIP, Subdomain | where count_ > 100. To detect DNS tunneling, you need to look for a high volume of queries to many unique subdomains from a single client, which indicates potential data exfiltration. Option A uses `summarize count() by ClientIP, Subdomain` and filters where the count is greater than 100, directly identifying clients with a large number of queries to different subdomains—a classic sign of DNS tunneling. Option B filters on response size > 1000, which may indicate large payloads but is not the primary indicator of tunneling. Option C filters on non-zero result codes, which may indicate failures but not specifically tunneling. Option D filters on query type 'A', which is too broad and does not isolate tunneling patterns.

Answer

DnsEvents | where ResponseSize > 1000

Answer

DnsEvents | where ResultCode != 0

Answer

DnsEvents | where QueryType == 'A'

Question 4

While hunting, you notice a user account has been created and then immediately added to the Domain Admins group. Which table in Microsoft 365 Defender should you query to find this event?

Accepted Answer

IdentityDirectoryEvents. IdentityDirectoryEvents captures directory service changes like group membership modifications. IdentityLogonEvents is for logons. IdentityQueryEvents is for LDAP queries. DeviceEvents is for system events. The correct table is IdentityDirectoryEvents.

Answer

IdentityQueryEvents

Answer

IdentityLogonEvents

Answer

DeviceEvents

Question 5

You are hunting for suspicious scheduled tasks that could be used for persistence. Which Microsoft 365 Defender advanced hunting table contains information about scheduled tasks?

Accepted Answer

DeviceEvents. DeviceEvents includes various system events, including scheduled task creation via EventID 4698. DeviceProcessEvents is for processes. DeviceNetworkEvents is for network. IdentityLogonEvents is for logons. The correct table is DeviceEvents.

Answer

IdentityLogonEvents

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Question 6

Which TWO data sources are essential for threat hunting in Microsoft Sentinel to detect lateral movement?

Accepted Answer

DeviceNetworkEvents (Microsoft Defender for Endpoint). DeviceNetworkEvents (Microsoft Defender for Endpoint) provides network connections between devices, which can reveal lateral movement attempts. SecurityEvent (Windows Event Logs) provides security-related events such as remote logons (Event ID 4624) and service creation (Event ID 7045), which are key indicators of lateral movement. Option A (Microsoft Entra ID sign-in logs) focuses on cloud identity and is not directly relevant for on-premises lateral movement. Option D (CommonSecurityLog) typically comes from network perimeter devices and is not essential for internal lateral movement. Option E (DnsEvents) can provide insight into DNS queries but is less essential than the other two data sources for detecting lateral movement.

Answer

Microsoft Entra ID sign-in logs

Answer

CommonSecurityLog (Syslog)

Answer

DnsEvents

Question 7

Which THREE indicators are commonly associated with ransomware activity in Microsoft Sentinel threat hunting?

Accepted Answer

Network connections to known C2 infrastructure. Ransomware activity commonly involves three indicators: network connections to known C2 infrastructure (command and control communication), mass file rename or extension changes (file encryption), and scheduled task creation on multiple endpoints (persistence mechanism). Option A (unusual DNS queries to known safe domains) is not typical for ransomware, and option C (excessive failed logon attempts) is more indicative of brute-force attacks. Therefore, the correct options are A, D, and E.

Answer

Unusual DNS queries to known safe domains

Answer

Excessive failed logon attempts from a single IP

Question 8

Which TWO Microsoft Sentinel hunting features can be used to automatically surface suspicious activities without manual query writing?

Accepted Answer

Livestream. Hunting queries are pre-built queries that can be scheduled to automatically surface suspicious activities. Livestream allows real-time monitoring of specific events without manual query writing. Option A (Workbooks) is for visualization, B (Analytics rules) is for detection, and D (Playbooks) is for automation. Therefore, the correct answers are C (Livestream) and E (Hunting queries).

Answer

Workbooks

Answer

Analytics rules

Answer

Playbooks

Question 9

You are reviewing a hunting query that identifies accounts with failed logons followed by successful logons from the same IP. The query returns no results even though you suspect brute force activity. What is the most likely issue?

Accepted Answer

The join condition is too strict; the SourceIP might differ between failed and successful logons. The join uses 'inner', which requires matching keys in both sides. If the IP is different for failed and successful logons (e.g., attacker changes IP), the join fails. Option A (time range) is unlikely. Option C (EventID) is correct. Option D (threshold) is not the issue. The correct answer is B.

Answer

The time range is too short

Answer

The threshold is too low

Answer

The EventID for successful logon is incorrect

Question 10

You are creating a custom hunting query in Microsoft Sentinel for PowerShell Empire indicators. After deploying, the query never returns results, even though you know empire activity exists in the environment. What is the most likely cause?

Accepted Answer

The query logic is flawed; it should group the conditions with parentheses. The query combines 'FileName contains 'powershell'' with 'ProcessCommandLine contains 'System.Net.WebClient'' and 'InitiatingProcessFileName contains 'powershell'' using OR and AND without parentheses. In KQL, AND has higher precedence than OR. Therefore, the query is evaluated as: (FileName contains 'powershell') OR (ProcessCommandLine contains '...' AND InitiatingProcessFileName contains '...'). This likely returns results that are not PowerShell Empire activity. To correctly identify PowerShell processes using WebClient, the conditions should be grouped: (FileName contains 'powershell' OR InitiatingProcessFileName contains 'powershell') AND ProcessCommandLine contains '...'. Option C is correct because the logic flaw is the missing parentheses. Option A (using 'and' instead of 'or') would make the query too restrictive. Option B (connector) is irrelevant; the query would work with the existing connector. Option D (changing 'contains' to 'startswith') would miss cases where the string appears mid-text.

Answer

The query should use 'and' instead of 'or'

Answer

The required data connector should be 'MicrosoftThreatProtection'

Answer

The 'contains' operator should be 'startswith'

Question 11

A threat hunter runs this KQL query to find devices making many outbound SMB connections. The result shows a device 'DC01' connecting to over 100 different IPs on port 445. What is the most likely explanation?

Accepted Answer

DC01 is performing normal domain operations like Group Policy distribution. A domain controller (DC01) making many outbound SMB connections to unique IPs is typical for normal activity such as Group Policy distribution and logon scripts. Option D correctly identifies this as normal domain operations. Option A (data exfiltration) is unlikely because SMB is not commonly used for exfiltration. Option B (network scanning) is possible but less likely for a DC under normal circumstances. Option C (malware spreading) is a concern but not the most probable explanation given the DC's role.

Answer

DC01 is exfiltrating data via SMB

Answer

DC01 is scanning the network for open SMB shares

Answer

DC01 is compromised and spreading malware

Question 12

You are performing a threat hunt in Microsoft Sentinel and have a KQL query that returns a high number of false positives. You want to reduce the noise without missing real threats. Which approach should you take?

Accepted Answer

Write a KQL query that looks for uncommon process chains, such as wscript.exe launched from Microsoft Office.. Threat hunting aims to find suspicious activity by looking for uncommon patterns, such as wscript.exe launched from Microsoft Office, which is a known technique for executing malicious scripts. This approach reduces false positives by targeting specific, relevant behavior. Option B is incorrect because simply excluding all Microsoft signed processes may miss legitimate threats that use signed binaries (e.g., living-off-the-land attacks). Option C is incorrect because broadening the time range or removing it entirely increases the volume of data, often leading to more noise and false positives. Option D is incorrect because removing the time filter eliminates a key control that helps focus on recent, relevant activity.

Answer

Add a filter to exclude all Microsoft signed processes.

Answer

Remove the time filter and run the query against all historical data.

Answer

Broaden the time range to capture more data.

Question 13

During a threat hunt in Microsoft Defender XDR, you notice repeated failed logon attempts from an IP address that belongs to a known anonymizer service. What is the first action you should take?

Accepted Answer

Initiate an investigation by reviewing the impacted user accounts and endpoints for signs of compromise.. The first step is to investigate the affected accounts and endpoints to determine if any compromise occurred. Option A may alert on false positives. Option B blocks access but may break legitimate business. Option D is premature without investigation.

Answer

Block the IP address in Microsoft Defender for Cloud Apps.

Answer

Create an analytics rule in Microsoft Sentinel to alert on all anonymizer IP addresses.

Answer

Report the IP to the Microsoft Sentinel Threat Intelligence team.

Question 14

Your threat hunting team is using Microsoft Sentinel with User and Entity Behavior Analytics (UEBA). You want to identify anomalous outbound data transfers that may indicate data exfiltration. Which KQL function should you use to compare current activity against a baseline?

Accepted Answer

behavioranalytics. (behavioranalytics) is correct because the behavioranalytics function in KQL leverages UEBA profiles to compare current activity against a baseline and detect anomalies. Option B (series_decompose) is for time series decomposition, not directly comparing to UEBA baselines. Option C (summarize) aggregates data but does not compare against baselines. Option D (make-series) creates time series but does not perform anomaly detection.

Answer

series_decompose

Answer

summarize

Answer

make-series

Question 15

You are reviewing a threat hunting KQL query in Microsoft Sentinel. The query references an external CSV containing malicious IPs. The query returns no results despite known malicious activity. What is the most likely issue?

Accepted Answer

The external CSV file is not accessible or the URL is malformed.. The query uses the externaldata operator to load an external CSV file. If the file URL is malformed or inaccessible, the query will not load any IPs, resulting in no matches. Option A is incorrect because externaldata is supported in Microsoft Sentinel. Option B is incorrect because the HuntingTimeRange variable is likely used correctly to filter by time, but time filtering is not the cause of zero results. Option C is incorrect because the project clause selects the RemoteIP column; it does not remove it.

Answer

The externaldata function is not supported in Microsoft Sentinel.

Answer

The HuntingTimeRange variable is not being used correctly.

Answer

The project clause removes the RemoteIP column.