SC-200 Perform threat hunting Practice Test 4 — 15 Questions

Question 1

You are a threat hunter at Fabrikam, a mid-sized company with 2,000 users. Your environment uses: Microsoft 365 E3 licenses; Microsoft Sentinel with the Microsoft 365 Defender connector; Microsoft Defender for Office 365; and Microsoft Defender for Endpoint (without Microsoft Defender for Identity). You are investigating a suspicious email campaign where some users received phishing emails with links to a credential harvesting page. You want to proactively search for any users who may have entered credentials on the phishing page. You have no direct logs from the phishing server. Which hunting approach should you use in Microsoft Sentinel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Query the UrlClickEvents table to identify users who clicked the malicious link, then correlate with AADSignInEventsBeta to find sign-ins from new IPs after the click.. The UrlClickEvents table in Microsoft 365 Defender logs URL click events from emails, including the user and URL. By querying this table, you can identify users who clicked the phishing link. Then, correlating with AADSignInEventsBeta allows you to check if those users subsequently signed in from new IP addresses, indicating potential credential compromise. This approach uses available logs without needing direct phishing server logs.

Answer

Query the DeviceProcessEvents table for any browser process that accessed the phishing URL.

Answer

Query the AADSignInEventsBeta table for users who signed in shortly after the email campaign from IPs not previously seen.

Answer

Query the EmailEvents table for users who received the phishing email and then check if they have any subsequent sign-in anomalies.

Question 2

You are a security analyst at Wingtip Toys, a small business with 500 users. You have Microsoft 365 Business Premium licenses and Microsoft Sentinel deployed. You are conducting a threat hunt for signs of brute-force attacks against your Azure AD tenant. You want to identify IP addresses that have attempted multiple failed sign-ins across different user accounts within a short time window. You have access to the SigninLogs table in Microsoft Sentinel. Which KQL query should you use?

Accepted Answer

SigninLogs | where ResultType !in ('0', '50125') | summarize FailedAttempts = count(), DistinctUsers = dcount(UserPrincipalName) by IPAddress | where FailedAttempts > 10 and DistinctUsers > 5 | order by FailedAttempts desc. The correct KQL query filters out successful sign-ins (ResultType != 0) and also excludes the specific error code 50125 (which indicates a successful sign-in with a password change, often not a failure). It then summarizes failed attempts and distinct users by IP address, filtering for IPs with more than 10 failed attempts and more than 5 distinct users, which indicates a brute-force attack across multiple accounts. This query directly addresses the requirement to identify IPs attempting multiple failed sign-ins across different user accounts.

Answer

SigninLogs | where ResultType != 0 | summarize FailedAttempts = count() by IPAddress | where FailedAttempts > 10

Answer

SigninLogs | where ResultType != 0 | top 10 by IPAddress

Answer

SigninLogs | where ResultType == 0 | summarize SuccessAttempts = count() by IPAddress | order by SuccessAttempts desc

Question 3

During a threat hunt, you notice an unusual number of DNS queries for randomly generated subdomains from a single workstation. You suspect data exfiltration via DNS tunneling. Which KQL query in Microsoft Sentinel would best help you identify the suspicious domain names?

Accepted Answer

let entropy_threshold = 4.0; let length_threshold = 20; CommonSecurityLog | where DeviceVendor == "Palo Alto" | extend entropy = strlen(DestinationHostName) - countof(DestinationHostName, 'a', 'z') / strlen(DestinationHostName) | where entropy > entropy_threshold or strlen(DestinationHostName) > length_threshold. It calculates entropy and length to detect algorithmically generated domains (DGA), a common indicator of DNS tunneling. Option B is incorrect because filtering out non-.com domains may miss many DGA domains. Option C is incorrect because it relies on a static threat intelligence list rather than dynamic analysis. Option D is incorrect because it only lists top domains by count without assessing randomness.

Answer

CommonSecurityLog | where DestinationHostName !endswith ".com"

Answer

CommonSecurityLog | where DestinationHostName in (dynamic_threat_intel_list)

Answer

CommonSecurityLog | where DeviceVendor == "Palo Alto" | summarize count() by DestinationHostName | top 10 by count_

Question 4

You are conducting a threat hunt for possible credential dumping using Mimikatz. Which Windows Security Event ID should you focus on in Microsoft Sentinel to detect potential use of Mimikatz?

Accepted Answer

Event ID 10 (Process accessed). Mimikatz's credential-dumping techniques (e.g., sekurlsa::logonpasswords) open a handle to lsass.exe with PROCESS_VM_READ, generating Windows Security Event ID 10 (Process accessed) with the target being lsass.exe. In Microsoft Sentinel, this event surfaces via the Sysmon or Windows Security Events connector and is a high-fidelity signal for credential theft.

Answer

Event ID 4688 (Process creation)

Answer

Event ID 4625 (Failed logon)

Answer

Event ID 5156 (WFP connection)

Question 5

Which TWO are common indicators of compromise (IOCs) used in threat hunting with Microsoft Sentinel?

Accepted Answer

File hashes (MD5, SHA256). File hashes (MD5, SHA256) (option A) are a classic atomic IOC because they uniquely identify known-malicious files and can be matched against Sentinel's Threat Intelligence connectors, watchlists, and analytics rules to detect malware across endpoints. IP addresses (option C) are likewise a standard network-based IOC used in Sentinel to flag command-and-control, exfiltration, or scanning activity via log queries and TI matching. Usernames (B), device names (D), and registry keys (E) can appear in hunting queries but are not typically classified as atomic IOCs on their own — usernames and device names are contextual entities rather than indicators, and registry keys are better described as host-based artifacts or TTP-related data unless paired with specific malicious values.

Answer

Usernames

Answer

Device names

Answer

Registry keys

Question 6

You are a security analyst at Contoso, a multinational company with 10,000 endpoints. You are using Microsoft Sentinel and Microsoft Defender XDR for threat hunting. In the past week, you have observed an increase in failed logon events (Event ID 4625) from multiple workstations towards a single domain controller, targeting the built-in Administrator account. The source IPs are a mix of internal and external addresses. You suspect a password spraying attack. You need to confirm the attack and identify all affected accounts. You have access to Windows Security Events ingested into Sentinel. Which single KQL query would best identify accounts with repeated failed logons across multiple source IPs, indicating password spraying?

Accepted Answer

SecurityEvent | where EventID == 4625 | summarize DistinctSourceIPs = dcount(IpAddress) by Account | where DistinctSourceIPs > 1. Password spraying is characterized by many accounts being targeted from multiple source IPs with a small number of attempts per account. The query that summarizes distinct source IPs per account and filters for more than one source IP best surfaces accounts targeted from multiple locations, which is the signature of spraying.

Answer

SecurityEvent | where EventID == 4625 | summarize FailedAttempts = count() by Account, IpAddress | where FailedAttempts > 10

Answer

SecurityEvent | where EventID == 4625 | summarize FailedAttempts = count() by Account | where FailedAttempts > 50

Answer

SecurityEvent | where EventID == 4625 and Account == 'Administrator' | summarize count() by IpAddress

Question 7

You are a security analyst at Fabrikam using Microsoft Sentinel. You are conducting a threat hunt for signs of remote code execution (RCE) via the Windows Event Log. You want to detect suspicious service creation that could indicate lateral movement. Specifically, you want to find events where a service was created (Event ID 7045) on a server, and within 5 minutes, a network connection was established from that server to another internal server. You have SecurityEvent and CommonSecurityLog tables ingested. Which KQL query should you use?

Accepted Answer

let ServiceCreation = SecurityEvent | where EventID == 7045 | project Computer, TimeGenerated; let NetworkConn = CommonSecurityLog | where DeviceAction == 'Allow' | project SourceIP, TimeGenerated; ServiceCreation | join kind=inner NetworkConn on $left.Computer == $right.SourceIP and abs(TimeGenerated - TimeGenerated) <= 5m. The intended query should build two named datasets (service creations from SecurityEvent EventID 7045, and allowed connections from CommonSecurityLog) and correlate them with a genuine time-windowed inner join. To do that correctly in KQL, the duplicate TimeGenerated column from the right-hand table must be referenced by its auto-renamed name (TimeGenerated1) after the join — e.g., '...| join kind=inner NetworkConn on $left.Computer == $right.SourceIP | where abs(TimeGenerated - TimeGenerated1) <= 5m' — otherwise the time-window condition silently collapses to comparing a column to itself. Additionally, joining Computer (hostname) directly to SourceIP (an IP address) will rarely match in real telemetry; a production version of this hunt would first resolve hostnames to IPs (or vice versa) via an enrichment/lookup step before joining, as the question's own deep-dive correctly notes.

Answer

SecurityEvent | where EventID == 7045 | union CommonSecurityLog | where TimeGenerated > ago(1d)

Answer

SecurityEvent | where EventID == 7045 | project Computer, TimeGenerated | where TimeGenerated > ago(1h)

Answer

SecurityEvent | where EventID == 7045 | where TimeGenerated between (ago(1d) .. now()) | summarize by Computer

Question 8

You are a security analyst at Wingtip Toys using Microsoft Defender XDR. You are hunting for signs of privilege escalation via the SeDebugPrivilege abuse. You want to find processes that have enabled SeDebugPrivilege and then accessed LSASS (Event ID 10). You have DeviceProcessEvents and DeviceEvents tables available. Which advanced hunting query would best identify this pattern?

Accepted Answer

DeviceProcessEvents | where FileName in ('procexp.exe', 'procmon.exe', 'cmd.exe', 'powershell.exe') | join kind=inner (DeviceEvents | where ActionType == 'SeDebugPrivilegeEnabled') on DeviceId | join kind=inner (DeviceEvents | where ActionType == 'LsassAccess') on DeviceId. This query joins DeviceProcessEvents (filtering for process names commonly used to enable SeDebugPrivilege, such as procexp.exe) with DeviceEvents for both SeDebugPrivilegeEnabled and LsassAccess, correlated by DeviceId. This identifies processes that enabled the privilege and then accessed LSASS, matching the hunting pattern. Option A is incorrect because filtering for lsass.exe itself does not capture the processes accessing it. Option B only summarizes LsassAccess events, missing the privilege enablement step. Option C only selects DeviceId from privilege enablement events, missing LSASS access.

Answer

DeviceProcessEvents | where FileName == 'lsass.exe'

Answer

DeviceEvents | where ActionType == 'LsassAccess' | summarize by DeviceId

Answer

DeviceEvents | where ActionType == 'SeDebugPrivilegeEnabled' | project DeviceId

Question 9

A threat hunter wants to use Jupyter Notebooks in Microsoft Sentinel for hypothesis-driven hunting. Which THREE steps should the hunter take to set up and use this capability?

Accepted Answer

Enable Machine Learning-based analytics in Microsoft Sentinel under 'Entity behavior' settings. To set up Jupyter notebooks in Microsoft Sentinel, the hunter must first enable Machine Learning-based analytics in Sentinel under 'Entity behavior' settings to leverage ML models in notebooks (A). Next, provision an Azure Machine Learning (AML) workspace in the same subscription to host the notebook environment (B). Finally, connect Sentinel to the AML workspace using the 'Notebooks' blade to access data and run queries (D). Installing MSTICpy separately is not required because it is pre-installed in the AML workspace; notebooks primarily use KQL for queries, not PowerShell runbooks.

Answer

Install the MSTICpy Python library on each hunting analyst's workstation

Answer

Create a PowerShell runbook to automate notebook execution

Question 10

Your organization uses Microsoft Defender for Identity (MDI) to monitor on-premises Active Directory. As a threat hunter, you receive an alert about a potential DCSync attack. You want to hunt for any other instances of this attack across your domain controllers over the past 30 days. Which hunting query should you run in Microsoft 365 Defender advanced hunting?

Accepted Answer

IdentityDirectoryEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'. DCSync attacks replicate directory data using the Directory Replication Service (DRS) protocol, which is captured by MDI as IdentityDirectoryEvents. The advanced hunting table IdentityDirectoryEvents contains directory-service and replication activity, including ActionType 'DCSync', making it the correct table for hunting this attack.

Answer

DeviceEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Answer

IdentityLogonEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Answer

IdentityQueryEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Question 11

Your team is using Microsoft Sentinel to hunt for signs of Kerberos golden ticket attacks. You have enabled Advanced Security Audit Policy on domain controllers to log Kerberos service ticket operations (Event ID 4769). You need to create a KQL query that identifies potential golden ticket use by looking for service tickets that have anomalous attributes, such as ticket encryption type 0x17 (RC4) combined with a long lifetime or unusual service names. Which KQL query should you use?

Accepted Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == '0x17' and (TicketOptions contains '0x2' or ServiceName !startswith 'krbtgt'). The correct query filters Event ID 4769 (Kerberos service ticket request) and looks for RC4 encryption (0x17), which is anomalous in modern environments that should use AES (0x12). It further narrows to tickets with TicketOptions containing 0x2 (forwardable) or ServiceName not starting with 'krbtgt', capturing the unusual service names and long-lifetime patterns typical of golden ticket use. This combination reduces false positives while surfacing forged TGT-derived service tickets.

Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == '0x17'

Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == '0x12' and TicketOptions contains '0x2'

Answer

SecurityEvent | where EventID == 4768 and TicketEncryptionType == '0x17'

Question 12

A threat hunter is analyzing a suspicious email that bypassed Microsoft Defender for Office 365. The email contains a link to a malicious website. The hunter wants to identify all users who clicked the link. Which hunting query in Microsoft 365 Defender should be used?

Accepted Answer

EmailUrlInfo. The correct Advanced Hunting table for finding who clicked a malicious link from a suspicious email is UrlClickEvents, not EmailUrlInfo. UrlClickEvents is populated by Safe Links and records each click with columns including AccountUpn (who clicked), Url, Timestamp, ActionType (whether Safe Links allowed or blocked the click), IsClickedThrough, and NetworkMessageId (to correlate back to the originating email). EmailUrlInfo only lists which URLs were present in a given email — it has no per-user click/timestamp data, so it cannot answer 'which users clicked the link.'

Answer

EmailAttachmentInfo

Answer

EmailEvents

Answer

DeviceFileEvents

Question 13

A threat hunter is investigating a potential data exfiltration incident. The hunter suspects that a user is using an unauthorized cloud storage service. Which Microsoft Defender for Cloud Apps signal would be most useful to detect this activity?

Accepted Answer

Cloud Discovery. Defender for Cloud Apps can discover shadow IT cloud apps. Option B is wrong because it does not detect cloud app usage. Option C is wrong because it is for web filtering, not cloud apps. Option D is wrong because it is for email protection.

Answer

Microsoft Defender for Endpoint Web Protection

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365 Safe Links

Question 14

A threat hunter wants to use KQL in Microsoft Sentinel to find all events from the SecurityEvent table where the event ID is 4625 (failed logon) and the account name is not 'SYSTEM'. Which query achieves this?

Accepted Answer

SecurityEvent | where EventID == 4625 and Account != 'SYSTEM'. It uses the proper KQL syntax: '==' for equality and '!=' for inequality. Option A is incorrect because 'equals' is not a KQL operator; KQL uses '=='. Option C is syntactically identical to B but is considered a duplicate and not the intended correct answer. Option D uses 'not Account ==' which is not valid KQL; the correct syntax to exclude a value is 'Account != 'SYSTEM'.

Answer

SecurityEvent | where EventID equals 4625 and Account not equals 'SYSTEM'

Answer

SecurityEvent | where EventID == 4625 and Account != 'SYSTEM'

Answer

SecurityEvent | where EventID == 4625 and not Account == 'SYSTEM'

Question 15

Your organization uses Microsoft Defender for Office 365. You want to hunt for phishing emails that bypassed the initial filtering. Which feature should you use to manually submit suspicious emails for analysis and then review the results in the Threat Explorer?

Accepted Answer

Threat Explorer. The Threat Explorer in Microsoft Defender for Office 365 provides forensic analysis of email threats and allows manual submission of suspicious emails for review. Option A is wrong because the Attack Simulator is for running simulated phishing attacks, not for submitting or analyzing suspect emails. Option C is wrong because the Quarantine portal is for managing messages that were already quarantined by policy, not for submitting new samples. Option D is wrong because Email trace in the Exchange admin center focuses on message flow and delivery status, not on detailed threat investigation.

Answer

Attack Simulator

Answer

Quarantine portal

Answer

Email trace in Exchange admin center