SC-200 Perform threat hunting Practice Test 3 — 15 Questions

Question 1

You are hunting for signs of ransomware activity. Which of the following behaviors in Microsoft Defender for Endpoint should you prioritize as a high-confidence indicator?

Accepted Answer

A process encrypting or renaming large numbers of files in rapid succession. A process encrypting or renaming large numbers of files in rapid succession is a high-confidence indicator of ransomware activity because ransomware typically encrypts files and may append extensions or rename them. This behavior is directly associated with the payload delivery and execution phase of a ransomware attack.

Answer

A process deleting Volume Shadow Copies

Answer

A process creating a scheduled task

Answer

A process downloading multiple files from the internet

Question 2

Which TWO of the following KQL functions are commonly used in threat hunting queries to identify outliers? (Choose TWO.)

Accepted Answer

percentile(). Options B and E are correct. B: `percentile()` helps identify outliers by finding values above a certain threshold. E: `bin()` with `summarize` aggregates data over time, enabling anomaly detection. Option A is wrong because `where()` filters rows, not for outlier detection. Option C is wrong because `project()` selects columns. Option D is wrong because `extend()` adds calculated columns, not for outlier identification.

Answer

where()

Answer

project()

Answer

extend()

Question 3

During a threat hunt in Microsoft Defender XDR, an analyst discovers that a specific user account has been executing unusual PowerShell commands from a non-corporate device. The analyst wants to investigate the timeline of these activities across all Microsoft 365 services. Which advanced hunting schema should be used to correlate these events?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents is the correct schema because it captures authentication and logon activities across Microsoft 365 services, including Microsoft Entra ID (Entra ID) sign-ins and related identity events. When a user account executes unusual PowerShell commands from a non-corporate device, the initial access and authentication events are recorded in IdentityLogonEvents, allowing the analyst to correlate the timeline of logon activities across all Microsoft 365 services. This schema provides details such as the user principal name, IP address, device information, and application used, which are essential for tracing the user's actions. Thus, it directly supports the requirement to investigate the timeline of activities across Microsoft 365 services.

Answer

DeviceEvents

Answer

CloudAppEvents

Answer

EmailEvents

Question 4

You are threat hunting in Microsoft Sentinel and have enabled UEBA. You want to detect a possible privilege escalation where a user creates a new user account and adds it to a privileged role within minutes. Which UEBA anomaly type should you investigate?

Accepted Answer

Mass role assignment changes. UEBA detects 'Mass role assignment changes' as an anomaly that could indicate privilege escalation. Option A (Unusual file access) is for data exfiltration. Option B (Impossible travel) is for geographic anomalies. Option D (Anomalous sign-in) focuses on authentication.

Answer

Unusual file access

Answer

Impossible travel

Answer

Anomalous sign-in

Question 5

A threat hunter is using Microsoft Defender XDR Advanced hunting to find evidence of credential dumping. Which table should be queried to detect use of tools like Mimikatz?

Accepted Answer

DeviceEvents. DeviceEvents in Microsoft Defender XDR Advanced Hunting contains process-level and device-level telemetry, including process creation events that capture command lines and parent-child process relationships. Credential dumping tools like Mimikatz execute as processes (e.g., mimikatz.exe, sekurlsa::logonpasswords) and often spawn from suspicious parents like Office apps or scripting engines, so their execution artifacts appear in DeviceEvents. Querying DeviceEvents for process creation and command-line patterns is the standard way to detect Mimikatz in Advanced Hunting.

Answer

CloudAppEvents

Answer

IdentityLogonEvents

Answer

EmailEvents

Question 6

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You are hunting for signs of a possible Kerberos Golden Ticket attack. Which advanced hunting table should you query to detect anomalous Kerberos ticket-granting ticket (TGT) requests?

Accepted Answer

IdentityDirectoryEvents. IdentityDirectoryEvents is the advanced hunting table in Microsoft Defender XDR that captures directory-service and identity-related activity from domain controllers, including Kerberos authentication events such as TGT and service ticket requests. Golden Ticket attacks forge TGTs using the KRBTGT account hash, so anomalous TGT issuance and Kerberos ticket events surface in this table. Querying IdentityDirectoryEvents lets hunters correlate account, device, and Kerberos ticket anomalies to detect forged TGTs.

Answer

IdentityLogonEvents

Answer

DeviceEvents

Answer

CloudAppEvents

Question 7

The exhibit shows a hunting query definition in Microsoft Sentinel. What is the primary issue with this hunting query?

Accepted Answer

The ipv4_lookup function is used incorrectly because it requires a data source parameter. The ipv4_lookup function in KQL is a plugin that requires a lookup table (data source) to be specified as its first argument, e.g., ipv4_lookup(LookupTable, 'IP', 'Network'). Without providing that external lookup table parameter, the function cannot resolve IP addresses to their corresponding network ranges, so the query as written is syntactically and semantically invalid. The other concerns (ActionType filter, timestamp filter) are stylistic or performance-related, not the primary structural defect.

Answer

The ActionType filter is invalid

Answer

The query does not filter by timestamp

Answer

The ipv4_lookup function does not exist in KQL

Question 8

Which THREE data sources should be included in a threat hunt to detect data exfiltration via DNS tunneling in Microsoft Sentinel?

Accepted Answer

Network flow logs (e.g., Azure Network Watcher). DNS events (from DNS servers or Azure DNS), network flow logs (to see volume), and Windows Event Logs (if DNS server logs are not directly available) can help detect DNS tunneling. Option B (Azure Key Vault logs) are for secret access. Option E (Microsoft 365 audit logs) are for user activities.

Answer

Azure Key Vault diagnostic logs

Answer

Microsoft 365 audit logs

Question 9

During a threat hunt in Microsoft Sentinel, you identify a series of successful logins from an unusual IP address to multiple Azure VM instances. The logins occur outside business hours. Which hunting technique would be most effective to correlate these events with potential lateral movement?

Accepted Answer

Use Microsoft Defender for Cloud Apps to perform session replay of the user's activities during that time.. Session replay in Microsoft Defender for Cloud Apps allows you to reconstruct the user's activities, showing the sequence of events across multiple VMs and identifying lateral movement patterns. Option A is wrong because correlating sign-in logs with Azure activity logs may identify concurrent events but doesn't reveal the step-by-step lateral movement. Option B is wrong because creating an alert rule is a detection mechanism, not a proactive hunting technique for correlating events. Option D is wrong because UEBA detects anomalies based on baselines but does not directly link the logins to lateral movement.

Answer

Run a KQL query that correlates sign-in logs with Azure activity logs using a common timestamp window.

Answer

Create a custom analytics rule in Microsoft Sentinel to alert on repeated logins from the same IP.

Answer

Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel to detect anomalies.

Question 10

Refer to the exhibit. You are reviewing a KQL query used in a threat hunting campaign. What is the primary purpose of this query?

Accepted Answer

To find users who have signed in more than 5 times from a single IP to an app, and correlate with any user risk events.. The query groups sign-ins by UserPrincipalName, IPAddress, and AppDisplayName, filters to those with more than 5 sign-ins (Count > 5), and then joins with risky user events to correlate with known risky users. Option A is incorrect because the query does not identify top 5 IPs; it filters by a threshold of 5 sign-ins. Option C is incorrect because the query does not calculate average risk score. Option D is incorrect because it does not list all sign-ins from risky IPs; it correlates sign-in patterns with user risk events.

Answer

To identify the top 5 most frequently used IP addresses by each user.

Answer

To calculate the average risk score for users with high sign-in activity.

Answer

To list all sign-ins from IP addresses that have been associated with risk events.

Question 11

You are a threat hunter investigating a potential data exfiltration via Microsoft Teams. You need to identify if any users have shared sensitive files externally. Which hunting approach should you use?

Accepted Answer

Use Microsoft Purview DLP reports to review incidents where sensitive files were shared externally via Teams.. Microsoft Purview DLP reports are specifically designed to track sensitive data shared externally, including via Teams. DLP policies can detect sensitive information types and generate incidents when files are shared with external users, providing the exact evidence needed for this investigation. This approach directly addresses the requirement to identify external sharing of sensitive files.

Answer

Analyze Microsoft Defender for Endpoint device timeline for file activity related to Teams.

Answer

Run a custom detection rule in Microsoft Defender for Cloud Apps to alert on large file uploads to Teams.

Answer

Query the Office 365 audit log for file download events from Teams.

Question 12

During a hunt, you discover that an attacker used a valid but compromised service principal to authenticate to Azure Key Vault and export secrets. Which Microsoft Sentinel hunting query would best identify similar activity across your environment?

Accepted Answer

ServicePrincipalSignInLogs | where ResultType == 0 | where ResourceDisplayName contains 'Key Vault'. ServicePrincipalSignInLogs records authentication events for service principals (app registrations and managed identities) and includes the resource being accessed. Filtering on ResultType == 0 (success) and ResourceDisplayName containing 'Key Vault' surfaces successful service principal sign-ins to Key Vault, which is exactly the pattern of a compromised service principal exporting secrets. This table is the authoritative source for non-interactive app authentication telemetry in Microsoft Entra ID.

Answer

AADManagedIdentitySignInLogs | where ResultType == 0

Answer

SigninLogs | where ResultType == 0 | where AppDisplayName contains 'Key Vault'

Answer

AADUserRiskEvents | where RiskEventType == 'compromised'

Question 13

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You are hunting for a threat that uses 'process hollowing' to evade detection. Which advanced hunting query in Microsoft Defender for Endpoint would be most effective?

Accepted Answer

DeviceProcessEvents | where InitiatingProcessFileName != ImageFileName | where ParentProcessFileName != ImageFileName. Process hollowing often involves a child process with a different parent image; DeviceProcessEvents can show such anomalies. Option B is wrong because it looks for specific image names. Option C is wrong because file events are less direct. Option D is wrong because it waits for alerts.

Answer

DeviceProcessEvents | where FileName in~ ('rundll32.exe', 'regsvr32.exe', 'mshta.exe')

Answer

DeviceFileEvents | where FileName contains 'hollow'

Answer

AlertInfo | where Title contains 'Process hollowing'

Question 14

Which TWO of the following are valid techniques for threat hunting using Microsoft Sentinel? (Select TWO.)

Accepted Answer

Using Jupyter notebooks with MSTICpy for advanced analytics.. Options C and D are correct threat hunting techniques in Microsoft Sentinel. C: Using Jupyter notebooks with MSTICpy enables advanced data analysis and visualization for proactive threat hunting. D: The Log Analytics Integrated Viewer (LIVB) provides an interactive interface to visually explore log data, aiding in hunting activities. A: Creating watchlists is a preparatory step for correlation but not a direct hunting technique. B: Deploying playbooks automates remediation, not hunting. E: Automation rules trigger on incident creation for response, not for proactive threat hunting.

Answer

Creating watchlists to correlate data from external sources.

Answer

Deploying playbooks to automatically remediate threats.

Answer

Configuring automation rules to trigger on incident creation.

Question 15

You are a threat hunter at Contoso, a multinational company with 10,000 employees. Your production environment includes: Microsoft 365 E5 licenses; Microsoft Sentinel in a central Log Analytics workspace; Microsoft Defender for Endpoint, Office 365, Identity, and Cloud Apps; and Microsoft Entra ID P2. You are tasked with hunting for a potential advanced persistent threat (APT) that may have compromised a high-privilege account. The threat intelligence team has reported that the APT group uses living-off-the-land binaries (LOLBins) to execute malicious code and uses encrypted tunnels to C2 servers. You need to design a hunting query in Microsoft Sentinel that correlates multiple data sources to identify suspicious LOLBin usage combined with unusual network connections. Which approach should you take?

Accepted Answer

Create a KQL query in Microsoft Sentinel that joins DeviceProcessEvents with DeviceNetworkEvents on DeviceId and a 1-minute time window, filtering for LOLBin processes and external IP connections.. The goal is to correlate process execution with network activity to surface LOLBin abuse tied to C2 traffic. Joining DeviceProcessEvents with DeviceNetworkEvents on DeviceId within a tight time window lets the query find processes like rundll32.exe or mshta.exe that spawned an outbound connection to an external IP, which is the classic LOLBin-plus-C2 pattern. This multi-table correlation in Sentinel is exactly what advanced hunting is designed for and gives the highest-fidelity signal.

Answer

Use the 'DeviceNetworkEvents' table alone to find connections to known malicious IPs from the threat intelligence feed.

Answer

Run a query in Advanced hunting that filters DeviceProcessEvents for known LOLBin file names like 'rundll32.exe' and 'mshta.exe', then manually review each instance.

Answer

Set up a custom detection rule in Microsoft Defender for Endpoint to alert on any LOLBin execution, then investigate the alerts.