SC-200 Perform threat hunting Practice Test 4 — 15 Questions

Question 1

You are reviewing a threat hunting KQL query in Microsoft Sentinel. The query references an external CSV containing malicious IPs. The query returns no results despite known malicious activity. What is the most likely issue?

Accepted Answer

The external CSV file is not accessible or the URL is malformed.. Option B is correct because externaldata reads the file at query time, and if the URL is unreachable or the file format differs, no IPs are loaded, resulting in no matches. Option A is less likely because the syntax is valid. Option C is possible but the query does not filter on time; it uses the variable. Option D is incorrect because the query projects relevant fields.

Answer

The externaldata function is not supported in Microsoft Sentinel.

Answer

The HuntingTimeRange variable is not being used correctly.

Answer

The project clause removes the RemoteIP column.

Question 2

You are a threat hunter and you want to identify potential lateral movement in your environment. Which Microsoft Defender XDR hunting table would you query to find network connections from a compromised workstation to other internal devices?

Accepted Answer

DeviceNetworkEvents. Option A is correct because DeviceNetworkEvents contains network connection events. Option B is for logon events. Option C is for process creation. Option D is for file creation events.

Answer

DeviceProcessEvents

Answer

DeviceLogonEvents

Answer

DeviceFileEvents

Question 3

You are analyzing the query above in Microsoft 365 Defender advanced hunting. The goal is to identify potentially compromised accounts used only once. The query returns thousands of results including many normal single logons. How can you refine the query to reduce false positives?

Accepted Answer

Add a filter to exclude IP addresses from the corporate VPN range and common applications like Outlook Web Access.. Option A is correct because filtering out known corporate IP ranges and common applications helps isolate anomalous single logons. Option B removes all single logons. Option C filters too broadly. Option D may miss external logons.

Answer

Change the where clause to LogonCount > 1.

Answer

Remove the filter on AccountUpn endswith "@contoso.com".

Answer

Add a filter to only include accounts that have never logged on before.

Question 4

During a threat hunt, you discover a PowerShell script that downloads and executes a payload from a known malicious URL. The script was run on multiple workstations. Which Microsoft Defender XDR action should you take to contain the threat?

Accepted Answer

Initiate a device isolation on the affected workstations using Microsoft Defender for Endpoint.. Option D is correct because Microsoft Defender for Endpoint can isolate devices to prevent further spread. Option A only removes the file but does not prevent re-infection. Option B blocks the URL but not the already infected machines. Option C is a detection, not containment.

Answer

Run a full antivirus scan on all affected workstations.

Answer

Add the URL to the custom indicator list in Microsoft Defender XDR.

Answer

Create a custom detection rule in Microsoft Sentinel.

Question 5

You are threat hunting for credential dumping activity. Which Windows event ID is commonly associated with the use of tools like Mimikatz?

Accepted Answer

4688 (Process Creation). Option C is correct because Windows Event ID 4688 (Process Creation) logs every new process spawned on the system, including the execution of tools like Mimikatz. When Mimikatz runs, it creates a process (e.g., mimikatz.exe), and the 4688 event captures the command line, parent process, and user context, which are critical for detecting credential dumping activity.

Answer

4624 (Successful Logon)

Answer

4768 (Kerberos Authentication Ticket Request)

Answer

4672 (Special Logon)

Question 6

You are creating a custom detection rule in Microsoft Sentinel using the JSON above. The rule does not trigger any alerts despite known PowerShell encoded commands executing. What is the most likely cause?

Accepted Answer

The filename 'powershell.exe' is case-sensitive and may not match actual events.. Option B is correct because the query is case-sensitive and 'powershell.exe' may be invoked as 'PowerShell.exe' with different casing. Option A is plausible but less likely because the file name is often lowercase. Option C is incorrect because the JSON has correct syntax. Option D is incorrect because the query is valid KQL.

Answer

The query uses 'contains' which is not supported in custom detections.

Answer

The query is missing a time filter.

Answer

The JSON has a syntax error.

Question 7

Which TWO Microsoft 365 Defender advanced hunting tables would you use together to investigate a potential data exfiltration via email?

Accepted Answer

EmailEvents. Option A (EmailEvents) and Option D (EmailAttachmentInfo) are correct because EmailEvents contains email metadata and EmailAttachmentInfo provides attachment details. Option B is for network events, not email. Option C is for cloud app activities. Option E is for endpoint processes.

Answer

DeviceNetworkEvents

Answer

CloudAppEvents

Answer

DeviceProcessEvents

Question 8

Which THREE actions are recommended when conducting a threat hunting exercise in Microsoft Sentinel using the MITRE ATT&CK framework?

Accepted Answer

Use the hunting queries from the Microsoft Sentinel Content hub as a starting point.. Options A, C, and E are correct. Mapping hypotheses to MITRE tactics ensures coverage; using hunting queries from the Content hub provides validated queries; and documenting findings supports future hunts. Option B is incorrect because you should not only hunt for known techniques. Option D is incorrect because you should not rely solely on automated rules.

Answer

Focus only on techniques that have not been seen in your environment before.

Answer

Rely exclusively on automated detection rules to identify threats.

Question 9

Which TWO data sources in Microsoft Sentinel are commonly used for threat hunting related to lateral movement?

Accepted Answer

DeviceNetworkEvents. Options B and D are correct. SecurityEvent (Windows Event Logs) contains Event ID 4624 (logon) and 4688 (process), useful for lateral movement. DeviceNetworkEvents (Microsoft Defender for Endpoint) shows network connections. Option A is for syslog, not Windows events. Option C is for DNS, which is less direct. Option E is for Azure activity, not lateral movement.

Answer

Syslog

Answer

DnsEvents

Answer

AzureActivity

Question 10

You are a threat hunter using PowerShell on a Windows 10 device. The command returns no output for a known threat ID. What is the most likely reason?

Accepted Answer

The threat has already been remediated and is no longer in the active threats list.. Option D is correct because Get-MpThreat retrieves threats detected by Windows Defender Antivirus; if the threat was already remediated or removed, the command may return no results. Option A is incorrect because the cmdlet exists. Option B is incorrect because admin rights are not required to query. Option C is incorrect because the threat ID is a number.

Answer

The Get-MpThreat cmdlet is deprecated.

Answer

The threat ID format is incorrect.

Answer

PowerShell must be run as administrator.

Question 11

You are using Microsoft Sentinel UEBA to hunt for insider threats. Which entity type would you investigate to detect unusual access to sensitive data?

Accepted Answer

User. Option B is correct because UEBA profiles user behavior, making 'User' the primary entity for detecting unusual access. Option A is for device-based anomalies. Option C is for IP-based anomalies. Option D is for application anomalies.

Answer

IP

Answer

Application

Answer

Device

Question 12

You are analyzing the KQL query above in Microsoft Sentinel. The query is designed to find devices with high outbound SMB (port 445) connections to suspicious public IPs. However, the query returns no results. What is the most likely issue?

Accepted Answer

The column RemoteIPType does not exist in DeviceNetworkEvents.. Option A is correct because RemoteIPType is not a standard column in DeviceNetworkEvents; the actual column is RemoteIPType, but it might be spelled differently or not exist, causing the filter to exclude all rows. Option B is incorrect because materialize is used correctly. Option C is incorrect because the syntax is valid. Option D is incorrect because port 445 is standard SMB.

Answer

Port 445 is not used for SMB.

Answer

The materialize function is not allowed in this context.

Answer

The syntax for the second query is incorrect.

Question 13

You are a security analyst using Microsoft Sentinel. You want to proactively search for signs of a specific threat actor known to use PowerShell encoded commands. Which hunting technique is most appropriate?

Accepted Answer

Use a hunting query in the Microsoft Sentinel hunting blade to search for PowerShell encoded commands.. Hunting queries in Microsoft Sentinel allow proactive searching for suspicious patterns. Option C is correct because it directly aligns with the need to create a custom KQL query to detect encoded PowerShell commands. Option A is incorrect because a watchlist is used for known indicators, not proactive hunting. Option B is incorrect because analytic rules create alerts after detection, not for proactive hunting. Option D is incorrect because UEBA identifies anomalies, not specific threat actor techniques.

Answer

Create an analytics rule to trigger an alert when PowerShell encoded commands are detected.

Answer

Create a watchlist of known malicious IPs and correlate with PowerShell events.

Answer

Enable UEBA to detect anomalous PowerShell usage.

Question 14

Your organization uses Microsoft Defender XDR for threat hunting. You suspect a threat actor is using scheduled tasks for persistence. Which hunting query would you use in Microsoft 365 Defender advanced hunting to find newly created scheduled tasks?

Accepted Answer

DeviceEvents | where ActionType == 'ScheduledTaskCreated'. Advanced hunting uses tables like DeviceEvents. Option B is correct because the ScheduledTaskCreated action in DeviceEvents captures scheduled task creation. Option A is incorrect because DeviceProcessEvents records process events, not scheduled tasks. Option C is incorrect because DeviceRegistryEvents is for registry changes. Option D is incorrect because DeviceFileEvents tracks file creation, not scheduled tasks directly.

Answer

DeviceRegistryEvents | where RegistryKey contains 'Tasks'

Answer

DeviceProcessEvents | where FileName == 'schtasks.exe'

Answer

DeviceFileEvents | where FolderPath contains 'Tasks'

Question 15

During a threat hunting exercise, you need to pivot from a suspicious IP address to find all related alerts and incidents in Microsoft Sentinel. Which feature should you use?

Accepted Answer

Investigation graph. The investigation graph in Microsoft Sentinel allows visual pivoting and exploration of entities. Option A is correct because it provides a graphical view of connections between entities. Option B is incorrect because the incidents blade shows incidents but not entity relationships. Option C is incorrect because playbooks automate responses. Option D is incorrect because workbooks are for dashboards.

Answer

Workbook

Answer

Incidents blade

Answer

Playbook

SC-200 Perform threat hunting Practice Test 4 — 15 Questions

Exhibit

SC-200 Perform threat hunting Practice Test 4 — 15 Questions

Exhibit