SC-200 Perform threat hunting Practice Test 5 — 15 Questions

Question 1

Your team is conducting a threat hunt for data exfiltration using Microsoft Defender for Cloud Apps. Which activity is most suspicious and should be included in the hunting query?

Accepted Answer

A user downloading hundreds of files from SharePoint Online in a short time.. Mass download of hundreds of files from SharePoint Online in a short time is a classic indicator of data exfiltration. Option D is correct. Option A is incorrect because viewing files is normal user activity and not indicative of exfiltration. Option B is incorrect because downloading a single file is routine and not suspicious. Option C is incorrect because sharing a file with an internal colleague is typical collaboration and less likely to be exfiltration than mass downloads or external sharing.

Answer

A user viewing files in OneDrive for Business.

Answer

A user downloading a single file from SharePoint Online.

Answer

A user sharing a file with an internal colleague.

Question 2

Which TWO techniques are commonly used in threat hunting with Microsoft Sentinel to identify lateral movement? (Choose two.)

Accepted Answer

Correlating service account usage with anomalous network connections.. Lateral movement in Microsoft Sentinel often involves techniques like remote execution and credential abuse. The correct answers are D (correlating service account usage with anomalous network connections) and E (identifying remote PowerShell execution across multiple machines). Option D is correct because service accounts are often targeted for lateral movement through credential theft, leading to anomalous connections. Option E is correct because remote PowerShell execution is a common lateral movement technique (e.g., PsExec, WinRM). Option A (port scanning) is typically reconnaissance, not lateral movement. Option B (multiple failed logons) indicates brute force attempts, which may precede lateral movement but are not direct evidence. Option C (mass file deletion) is often related to cleanup after exfiltration, not lateral movement.

Answer

Detecting port scanning activity from internal IPs.

Answer

Searching for multiple failed logon attempts from a single IP.

Answer

Looking for mass file deletion events on file servers.

Question 3

Which THREE approaches are effective for hunting threats in Microsoft Defender XDR using advanced hunting? (Choose three.)

Accepted Answer

Using known indicators of compromise (IOCs) from threat intelligence feeds.. Effective hunting in Microsoft Defender XDR using advanced hunting involves proactive approaches: using known IOCs from threat intelligence (A) helps identify known threats; establishing a baseline of normal behavior and hunting for deviations (B) detects anomalies; applying machine learning models (E) leverages automated anomaly detection. Option C is incorrect because reviewing all alerts is reactive and not a hunting technique. Option D is incorrect because hunting looks for patterns, not isolated unusual events.

Answer

Reviewing all alerts generated by automated detection rules.

Answer

Searching for any single event that appears unusual.

Question 4

Which TWO data sources in Microsoft Sentinel are most valuable for hunting for command-and-control (C2) communications? (Choose two.)

Accepted Answer

DNS logs (e.g., from DNS servers or Azure DNS Analytics). Command-and-control (C2) communications often involve network traffic and DNS queries to external servers. DNS logs (C) can reveal suspicious domain resolution patterns, while network traffic logs (E) can detect anomalous connections. Windows Event Logs (A) and Azure Activity Log (B) are less direct for C2 detection, and Syslog (D) may not capture all network traffic.

Answer

Windows Event Logs (e.g., Security, System)

Answer

Azure Activity log

Answer

Syslog from Linux servers

Question 5

Refer to the exhibit. This JSON defines a scheduled analytics rule in Microsoft Sentinel. Which type of threat is the rule primarily designed to detect?

Accepted Answer

Script-based malware execution attempting C2 communication. The query targets rundll32.exe executing JavaScript (common for script-based malware) making outbound HTTP connections, which is indicative of command-and-control (C2) communication. This aligns with script-based malware execution attempting C2 (option A). Option B is incorrect because no lateral movement indicators (e.g., RDP or remote service creation) are present. Option C is incorrect because there is no sign of LSASS access or credential dumping. Option D is incorrect because DNS tunneling involves specific DNS query patterns, not general outbound HTTP.

Answer

Lateral movement using remote desktop

Answer

Credential dumping via LSASS

Answer

Data exfiltration via DNS tunneling

Question 6

Refer to the exhibit. This KQL query is used for threat hunting in Microsoft Defender XDR. What is the primary goal of this query?

Accepted Answer

Find users with an unusually high number of successful logons compared to their own baseline.. The query calculates a per-user baseline of daily successful logon counts over the last 30 days, then identifies users whose logon count in the last day exceeds 2 standard deviations above their own mean. Option C correctly describes this anomaly detection. Option A is incorrect because the query does not correlate multiple users from the same IP; it focuses on individual user baselines. Option B is incorrect because the query does not include geographic location data; it only analyzes logon count. Option D is incorrect because the query counts successful logons, not failed ones.

Answer

Detect brute force attacks by correlating multiple users from the same IP.

Answer

Identify logons from unusual geographic locations.

Answer

Identify users with failed logon attempts exceeding a threshold.

Question 7

You are threat hunting for signs of Microsoft 365 mailbox compromise. Which hunting query in Microsoft 365 Defender would be most effective for identifying suspicious mailbox forwarding rules?

Accepted Answer

EmailEvents | where EmailAction == 'Forward'. Mailbox forwarding rules are captured in the EmailEvents table. Option A correctly uses EmailEvents and filters for forwarding actions. Option B is incorrect because DeviceEvents is for device-related events, not mailbox events. Option C is incorrect because AlertInfo is for alert metadata, not raw events. Option D is incorrect because EmailPostDeliveryEvents is for post-delivery actions, not forwarding rules.

Answer

DeviceEvents | where ActionType contains 'Mailbox'

Answer

AlertInfo | where Title contains 'forward'

Answer

EmailPostDeliveryEvents | where Action == 'Forward'

Question 8

During a threat hunt in Microsoft Sentinel, you find a series of suspicious sign-ins to Microsoft Entra ID from an IP address known to be associated with a threat actor. Which entity should you pivot on to investigate further?

Accepted Answer

IP address. The IP address is the key entity that links all suspicious sign-ins and is the initial pivot point for investigation. Option A is correct because the IP address is the common element across the sign-ins. Options B, C, and D are incorrect: the user account, application, and device may be related but are not the primary pivot from the IP address.

Answer

User account

Answer

Application

Answer

Device

Question 9

Refer to the exhibit. The KQL query is used for threat hunting in Microsoft Defender XDR. What is the most likely scenario this query is designed to detect?

Accepted Answer

Ransomware dropping executables on desktops and spreading via SMB. The query searches for .scr files (often used to disguise executables) on desktop folders with names matching eight lowercase letters and correlates with outbound SMB connections to private IPs. This pattern is commonly associated with ransomware that drops executables on compromised desktops and spreads laterally via SMB. Therefore, option B (Ransomware dropping executables on desktops and spreading via SMB) is correct. Option A is incorrect because the file is on the desktop, not in the startup folder. Option C is incorrect as there are no registry events. Option D is incorrect because the file extension is .scr, not .lnk.

Answer

Persistence mechanism via startup folder

Answer

Registry modification to disable security tools

Answer

Phishing campaign delivering .lnk files

Question 10

You are a SOC analyst using Microsoft Sentinel. You need to create a hunting query that searches for unusual outbound RDP connections from workstations. Which KQL operators or functions would be most essential for this query?

Accepted Answer

DeviceNetworkEvents and where LocalPort == 3389 and RemoteIPType == 'Public'. Hunting for outbound RDP requires identifying connections on port 3389 from workstations. Option B is correct because DeviceNetworkEvents includes network connections and port information. Option A is incorrect because DeviceProcessEvents is for process events, not network connections. Option C is incorrect because DeviceLogonEvents is for logon sessions, not network connections. Option D is incorrect because DeviceEvents may not include network details.

Answer

DeviceProcessEvents and where ProcessCommandLine contains 'mstsc'

Answer

DeviceLogonEvents and where LogonType == 'RemoteInteractive'

Answer

DeviceEvents and where ActionType contains 'RDP'

Question 11

An analyst is reviewing a series of alerts in Microsoft Defender XDR indicating potential lateral movement. Which KQL query in Microsoft Sentinel would best identify anomalous RDP connections to servers not typically accessed remotely?

Accepted Answer

DeviceNetworkEvents | where RemotePort == 3389 | summarize dcount(DestinationIP) by DeviceName | where dcount_DestinationIP > 5. The `DeviceNetworkEvents` table in Microsoft Defender XDR logs network connections, and filtering for RDP port 3389 with a count of distinct destination IPs over a threshold helps identify unusual RDP patterns that may indicate lateral movement. Option A is wrong because `DeviceProcessEvents` logs process creation, not network connections. Option B is wrong because `DeviceRegistryEvents` logs registry changes, not network connections. Option D is wrong because `DeviceLogonEvents` logs authentication events; while LogonType 10 indicates remote interactive logon, it does not specifically target RDP connections and does not correlate with multiple distinct destinations.

Answer

DeviceProcessEvents | where ProcessCommandLine contains '3389'

Answer

DeviceRegistryEvents | where RegistryKey contains 'Remote Desktop'

Answer

DeviceLogonEvents | where LogonType == '10' | summarize dcount(DeviceName) by AccountName

Question 12

You are investigating a potential data exfiltration incident. You notice a user uploading large amounts of data to a cloud storage service that the organization has not approved. Which Microsoft Defender XHR feature would best help you hunt for similar patterns across all users?

Accepted Answer

Advanced hunting in Microsoft Defender XDR. Advanced hunting allows you to write custom KQL queries to detect patterns like large uploads to unapproved cloud storage. Option A is wrong because custom detection rules are for creating alerts based on queries, but the question asks for hunting. Option C is wrong because incident investigation focuses on a single incident, not proactive hunting. Option D is wrong because automation rules automate responses, not hunting.

Answer

Custom detection rules in Microsoft Sentinel

Answer

Incident investigation graph in Microsoft Defender XDR

Answer

Automation rules in Microsoft Sentinel

Question 13

During a threat hunt, you want to identify processes that have made network connections to known malicious IP addresses. Which data source in Microsoft Defender for Endpoint would provide the necessary information?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents logs network connections including destination IP addresses, which is needed for this threat hunt. Option A is wrong because DeviceFileEvents logs file operations, not network connections. Option C is wrong because DeviceProcessEvents logs process creation, not network connections. Option D is wrong because DeviceRegistryEvents logs registry changes, not network connections.

Answer

DeviceFileEvents

Answer

DeviceProcessEvents

Answer

DeviceRegistryEvents

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to create a hunting query that finds users who have accessed a high number of distinct Azure resources within a short time frame, which may indicate credential theft. Which KQL query would be most effective?

Accepted Answer

AzureActivity | where TimeGenerated > ago(1d) | summarize dcount(Resource) by Caller, bin(TimeGenerated, 1h) | where dcount_Resource > 20. It uses the AzureActivity table to count distinct resources per user per hour, filtering for those with more than 20 resources. Option A is wrong because it uses a 1-minute bucket, too granular for meaningful hunting. Option B is wrong because it counts operations, not distinct resources. Option C is wrong because it counts distinct operation names, not resources.

Answer

AzureActivity | summarize dcount(Resource) by bin(TimeGenerated, 1m), Caller

Answer

AzureActivity | summarize count() by Caller | where count_ > 20

Answer

AzureActivity | summarize dcount(OperationName) by Caller, bin(TimeGenerated, 1h) | where dcount_OperationName > 20

Question 15

You are hunting for signs of credential dumping using Mimikatz. Which process events in Microsoft Defender for Endpoint would most likely indicate this activity?

Accepted Answer

A process opening lsass.exe with access to process memory (e.g., PROCESS_VM_READ). Mimikatz typically opens lsass.exe with specific access permissions like PROCESS_VM_READ to read process memory and dump credentials. Options B, C, and D are not specific indicators: PowerShell making network connections is too broad, svchost spawning from explorer is a normal pattern, and cmd executing whoami is not credential dumping.

Answer

A process named powershell.exe making network connections to an external IP

Answer

A process named svchost.exe spawning from explorer.exe

Answer

A process named cmd.exe executing whoami