SC-200 Perform threat hunting Practice Test 4 — 15 Questions

Question 1

You are a threat hunter and you want to identify potential lateral movement in your environment. Which Microsoft Defender XDR hunting table would you query to find network connections from a compromised workstation to other internal devices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeviceNetworkEvents. (DeviceNetworkEvents). This table contains network connection events, such as outbound and inbound connections, making it ideal for identifying lateral movement via network connections from a compromised workstation to other internal devices. Option A (DeviceProcessEvents) captures process creation events, not network connections. Option B (DeviceLogonEvents) records authentication events. Option D (DeviceFileEvents) logs file creation and modification events. None of these directly show network connections.

Answer

DeviceProcessEvents

Answer

DeviceLogonEvents

Answer

DeviceFileEvents

Question 2

You are analyzing the query above in Microsoft 365 Defender advanced hunting. The goal is to identify potentially compromised accounts used only once. The query returns thousands of results including many normal single logons. How can you refine the query to reduce false positives?

Accepted Answer

Add a filter to exclude IP addresses from the corporate VPN range and common applications like Outlook Web Access.. Adding a filter to exclude IP addresses from the corporate VPN range and common applications (like Outlook Web Access) helps reduce false positives by removing legitimate single logons that are expected. Option A (LogonCount > 1) would exclude the very accounts we are trying to find (single logons). Option B (removing the domain filter) would expand results but not necessarily reduce false positives. Option C (accounts never logged on before) is too restrictive and may miss compromised accounts used only once.

Answer

Change the where clause to LogonCount > 1.

Answer

Remove the filter on AccountUpn endswith "@contoso.com".

Answer

Add a filter to only include accounts that have never logged on before.

Question 3

During a threat hunt, you discover a PowerShell script that downloads and executes a payload from a known malicious URL. The script was run on multiple workstations. Which Microsoft Defender XDR action should you take to contain the threat?

Accepted Answer

Initiate a device isolation on the affected workstations using Microsoft Defender for Endpoint.. Device isolation in Microsoft Defender for Endpoint immediately contains the threat by disconnecting the affected workstations from the network, preventing further spread or command-and-control communication. Option A only scans but does not prevent re-infection if the payload is still active. Option B blocks the URL but does not remediate already infected machines. Option D is about detection in Sentinel, not containment.

Answer

Run a full antivirus scan on all affected workstations.

Answer

Add the URL to the custom indicator list in Microsoft Defender XDR.

Answer

Create a custom detection rule in Microsoft Sentinel.

Question 4

You are creating a custom detection rule in Microsoft Sentinel using the JSON above. The rule does not trigger any alerts despite known PowerShell encoded commands executing. What is the most likely cause?

Accepted Answer

The filename 'powershell.exe' is case-sensitive and may not match actual events.. The query uses a case-sensitive match for 'powershell.exe', but actual events may use 'PowerShell.exe' or other casing, causing the rule not to trigger. Option A is incorrect because 'contains' is supported in custom detection rules. Option B is incorrect because time filters are optional and not required for the rule to trigger. Option C is incorrect because the JSON syntax is valid.

Answer

The query uses 'contains' which is not supported in custom detections.

Answer

The query is missing a time filter.

Answer

The JSON has a syntax error.

Question 5

Which TWO Microsoft 365 Defender advanced hunting tables would you use together to investigate a potential data exfiltration via email?

Accepted Answer

EmailEvents. (EmailEvents) is correct because it contains email metadata such as sender, recipient, subject, and delivery details. Option B (EmailAttachmentInfo) is correct because it provides details about attachments in emails, including file names and sizes. Together, they allow investigation of data exfiltration via email by correlating email events with attachment data. Option C (DeviceNetworkEvents) focuses on network connections from devices, not email. Option D (CloudAppEvents) covers activities in cloud applications, not specifically email. Option E (DeviceProcessEvents) deals with process executions on endpoints, irrelevant to email exfiltration.

Answer

DeviceNetworkEvents

Answer

CloudAppEvents

Answer

DeviceProcessEvents

Question 6

Which THREE actions are recommended when conducting a threat hunting exercise in Microsoft Sentinel using the MITRE ATT&CK framework?

Accepted Answer

Use the hunting queries from the Microsoft Sentinel Content hub as a starting point.. Options B, D, and E are recommended actions. B: Using hunting queries from the Microsoft Sentinel Content hub provides a validated starting point. D: Documenting findings and updating detection rules helps improve future hunts. E: Mapping hypotheses to MITRE ATT&CK tactics and techniques ensures comprehensive coverage. A is incorrect because focusing only on unseen techniques ignores known threats that may still be active. C is incorrect because relying exclusively on automated detection rules can miss advanced persistent threats that require manual hunting.

Answer

Focus only on techniques that have not been seen in your environment before.

Answer

Rely exclusively on automated detection rules to identify threats.

Question 7

Which TWO data sources in Microsoft Sentinel are commonly used for threat hunting related to lateral movement?

Accepted Answer

DeviceNetworkEvents. Options A and C are correct. DeviceNetworkEvents (Microsoft Defender for Endpoint) logs network connections, which can reveal lateral movement attempts between devices. SecurityEvent (Windows Event Logs) contains Event ID 4624 (logon) and 4688 (process creation), both critical for identifying lateral movement. Option B (Syslog) is a general logging protocol not specific to lateral movement. Option D (DnsEvents) is more relevant to command and control or data exfiltration. Option E (AzureActivity) tracks Azure resource operations, not lateral movement within the environment.

Answer

Syslog

Answer

DnsEvents

Answer

AzureActivity

Question 8

You are a threat hunter using PowerShell on a Windows 10 device. The command returns no output for a known threat ID. What is the most likely reason?

Accepted Answer

The threat has already been remediated and is no longer in the active threats list.. Get-MpThreat only returns active threats; if the threat has already been remediated or removed, it will not appear in the output. Option A is incorrect because Get-MpThreat is not deprecated and still exists. Option B is incorrect because the threat ID format (number) is correct for a known threat ID. Option D is incorrect because querying Get-MpThreat does not require administrator privileges.

Answer

The Get-MpThreat cmdlet is deprecated.

Answer

The threat ID format is incorrect.

Answer

PowerShell must be run as administrator.

Question 9

You are using Microsoft Sentinel UEBA to hunt for insider threats. Which entity type would you investigate to detect unusual access to sensitive data?

Accepted Answer

User. (User) is correct because UEBA profiles user behavior, making 'User' the primary entity for detecting unusual access to sensitive data. Option A (IP) focuses on network location anomalies, not user intent. Option B (Application) tracks application usage patterns, not direct access to data. Option C (Device) identifies device-based anomalies, such as compromised hardware, rather than user-driven access.

Answer

IP

Answer

Application

Answer

Device

Question 10

You are analyzing the KQL query above in Microsoft Sentinel. The query is designed to find devices with high outbound SMB (port 445) connections to suspicious public IPs. However, the query returns no results. What is the most likely issue?

Accepted Answer

The column RemoteIPType does not exist in DeviceNetworkEvents.. The column RemoteIPType does not exist in the DeviceNetworkEvents table. The query attempts to filter on RemoteIPType, but this column is not present, causing the query to return no results. Option A is incorrect because port 445 is indeed used by SMB. Option C is incorrect because the materialize function is allowed in this context. Option D is incorrect because the syntax of the second query is valid.

Answer

Port 445 is not used for SMB.

Answer

The materialize function is not allowed in this context.

Answer

The syntax for the second query is incorrect.

Question 11

You are a security analyst using Microsoft Sentinel. You want to proactively search for signs of a specific threat actor known to use PowerShell encoded commands. Which hunting technique is most appropriate?

Accepted Answer

Use a hunting query in the Microsoft Sentinel hunting blade to search for PowerShell encoded commands.. Hunting queries in Microsoft Sentinel allow proactive searching for suspicious patterns. Option D is correct because it directly aligns with the need to create a custom KQL query to detect encoded PowerShell commands in the hunting blade. Option A is incorrect because analytics rules trigger alerts after detection, not for proactive hunting. Option B is incorrect because a watchlist is used for correlation with known indicators, not proactive hunting. Option C is incorrect because UEBA identifies anomalies, not specific threat actor techniques.

Answer

Create an analytics rule to trigger an alert when PowerShell encoded commands are detected.

Answer

Create a watchlist of known malicious IPs and correlate with PowerShell events.

Answer

Enable UEBA to detect anomalous PowerShell usage.

Question 12

Your organization uses Microsoft Defender XDR for threat hunting. You suspect a threat actor is using scheduled tasks for persistence. Which hunting query would you use in Microsoft 365 Defender advanced hunting to find newly created scheduled tasks?

Accepted Answer

DeviceEvents | where ActionType == 'ScheduledTaskCreated'. Advanced hunting uses the DeviceEvents table to capture various security events, including scheduled task creation via the 'ScheduledTaskCreated' action type. Option A is correct because DeviceEvents with ActionType 'ScheduledTaskCreated' directly identifies newly created scheduled tasks. Option B (DeviceRegistryEvents) is incorrect because it captures registry modifications, and while scheduled tasks are stored in the registry, querying for 'Tasks' in the registry key is too broad and not specific to creation. Option C (DeviceProcessEvents) is incorrect because 'schtasks.exe' is the command-line tool used to create scheduled tasks, but querying for process events would capture executions rather than the actual creation of tasks, and it may miss tasks created via other methods. Option D (DeviceFileEvents) is incorrect because it tracks file operations, and scheduled tasks are not typically represented as files in a folder; the 'Tasks' folder path might refer to the Windows Task Scheduler library, but file events for task files (like .job files) are not the primary way to detect creation.

Answer

DeviceRegistryEvents | where RegistryKey contains 'Tasks'

Answer

DeviceProcessEvents | where FileName == 'schtasks.exe'

Answer

DeviceFileEvents | where FolderPath contains 'Tasks'

Question 13

During a threat hunting exercise, you need to pivot from a suspicious IP address to find all related alerts and incidents in Microsoft Sentinel. Which feature should you use?

Accepted Answer

Investigation graph. The investigation graph in Microsoft Sentinel allows visual pivoting and exploration of entities, making it the correct tool for pivoting from a suspicious IP to find related alerts and incidents. Option A (Workbooks) is incorrect because workbooks are for creating dashboards and reports. Option B (Incidents blade) is incorrect because it shows incidents but does not provide entity relationship visualization. Option D (Playbook) is incorrect because playbooks automate responses, not pivot investigations.

Answer

Workbook

Answer

Incidents blade

Answer

Playbook

Question 14

Refer to the exhibit. The KQL query is used for threat hunting in Microsoft 365 Defender. What is the primary purpose of this query?

Accepted Answer

Identify periods of high scheduled task creation activity that may indicate lateral movement.. The query filters DeviceEvents for scheduled task creation (ActionType == 'ScheduledTaskCreated'), then groups by ActionType and hourly buckets, counting events. It then filters for hours with more than 10 events, highlighting periods of high scheduled task creation activity. This can indicate lateral movement, as attackers often create scheduled tasks on multiple machines. Option C correctly identifies this purpose. Option A is incorrect because it does not list specific tasks; it aggregates counts. Option B is incorrect because it does not correlate with known threat actor techniques. Option D is incorrect because it does not calculate a baseline; it uses a fixed threshold.

Answer

List all scheduled tasks created in the last 7 days.

Answer

Correlate scheduled task creation with known threat actor techniques.

Answer

Calculate the baseline of scheduled task creation per hour.

Question 15

You are hunting for signs of Kerberoasting in Microsoft Sentinel. Which hunting query using KQL would you use to identify service principal names (SPNs) being queried via Kerberos TGS requests?

Accepted Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == 0x17. Kerberoasting involves requesting TGS tickets for Service Principal Names (SPNs). In Microsoft Sentinel, the SecurityEvent table with EventID 4769 logs TGS requests. TicketEncryptionType 0x17 indicates RC4 encryption, which is commonly used in Kerberoasting attacks. Option A correctly identifies this query. Option D is incorrect because EventID 4768 is for TGT requests, not TGS. Option B (DeviceEvents) may not capture this specific event, and Option C (DeviceLogonEvents) does not focus on SPN details.

Answer

DeviceEvents | where ActionType == 'KerberosTicketRequest'

Answer

DeviceLogonEvents | where LogonType == 'Kerberos' and AccountDomain == 'Service'

Answer

SecurityEvent | where EventID == 4768 and TicketEncryptionType == 0x17