SC-200 Perform threat hunting Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. The KQL query is used for threat hunting in Microsoft 365 Defender. What is the primary purpose of this query?

Accepted Answer

Identify periods of high scheduled task creation activity that may indicate lateral movement.. The query filters for scheduled task events, groups by ActionType and hourly buckets, then returns only those hours with more than 10 events. Option A is correct because it identifies high-frequency scheduled task activity, which could indicate lateral movement or persistence. Option B is incorrect because it does not compare to a baseline. Option C is incorrect because it does not list specific tasks. Option D is incorrect because it does not correlate with known threats.

Answer

List all scheduled tasks created in the last 7 days.

Answer

Correlate scheduled task creation with known threat actor techniques.

Answer

Calculate the baseline of scheduled task creation per hour.

Question 2

You are hunting for signs of Kerberoasting in Microsoft Sentinel. Which hunting query using KQL would you use to identify service principal names (SPNs) being queried via Kerberos TGS requests?

Accepted Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == 0x17. Kerberoasting involves requesting TGS tickets for SPNs. Option D is correct because SecurityEvent 4769 logs TGS requests, and TicketEncryptionType 0x17 indicates RC4 encryption used in Kerberoasting. Option A is incorrect because Event 4768 is for TGT requests. Option B is incorrect because DeviceLogonEvents may not contain SPN details. Option C is incorrect because DeviceEvents may not capture this security event.

Answer

DeviceEvents | where ActionType == 'KerberosTicketRequest'

Answer

DeviceLogonEvents | where LogonType == 'Kerberos' and AccountDomain == 'Service'

Answer

SecurityEvent | where EventID == 4768 and TicketEncryptionType == 0x17

Question 3

Your team is conducting a threat hunt for data exfiltration using Microsoft Defender for Cloud Apps. Which activity is most suspicious and should be included in the hunting query?

Accepted Answer

A user downloading hundreds of files from SharePoint Online in a short time.. Mass download of files from a cloud app is a classic exfiltration indicator. Option B is correct. Option A is incorrect because single file download is normal. Option C is incorrect because viewing files is not exfiltration. Option D is incorrect because sharing within the organization is less suspicious than external sharing.

Answer

A user viewing files in OneDrive for Business.

Answer

A user downloading a single file from SharePoint Online.

Answer

A user sharing a file with an internal colleague.

Question 4

Which TWO techniques are commonly used in threat hunting with Microsoft Sentinel to identify lateral movement? (Choose two.)

Accepted Answer

Correlating service account usage with anomalous network connections.. Lateral movement often involves remote execution and credential theft. Options B and D are correct. Option A is incorrect because failed logins may indicate brute force but not necessarily lateral movement. Option C is incorrect because port scans are reconnaissance. Option E is incorrect because file deletion is often cleanup.

Answer

Detecting port scanning activity from internal IPs.

Answer

Searching for multiple failed logon attempts from a single IP.

Answer

Looking for mass file deletion events on file servers.

Question 5

Which THREE approaches are effective for hunting threats in Microsoft Defender XDR using advanced hunting? (Choose three.)

Accepted Answer

Using known indicators of compromise (IOCs) from threat intelligence feeds.. Effective hunting includes using known IOCs, behavioral baselines, and anomaly detection. Options B, C, and E are correct. Option A is incorrect because alerts are reactive. Option D is incorrect because a single event is not sufficient.

Answer

Reviewing all alerts generated by automated detection rules.

Answer

Searching for any single event that appears unusual.

Question 6

Which TWO data sources in Microsoft Sentinel are most valuable for hunting for command-and-control (C2) communications? (Choose two.)

Accepted Answer

DNS logs (e.g., from DNS servers or Azure DNS Analytics). C2 communications generate network traffic and DNS queries. Options A and D are correct. Option B is incorrect because Windows event logs are less direct. Option C is incorrect because syslog may not capture all network traffic. Option E is incorrect because Azure Activity focuses on management plane.

Answer

Windows Event Logs (e.g., Security, System)

Answer

Azure Activity log

Answer

Syslog from Linux servers

Question 7

Refer to the exhibit. This JSON defines a scheduled analytics rule in Microsoft Sentinel. Which type of threat is the rule primarily designed to detect?

Accepted Answer

Script-based malware execution attempting C2 communication. The query combines rundll32.exe with javascript (often used for script-based execution) and outbound HTTP connections (C2). Option B is correct. Option A is incorrect because no lateral movement is detected. Option C is incorrect because credential theft is not indicated. Option D is incorrect because the query is about outbound connections, not file exfiltration.

Answer

Lateral movement using remote desktop

Answer

Credential dumping via LSASS

Answer

Data exfiltration via DNS tunneling

Question 8

Refer to the exhibit. This KQL query is used for threat hunting in Microsoft Defender XDR. What is the primary goal of this query?

Accepted Answer

Find users with an unusually high number of successful logons compared to their own baseline.. The query calculates a baseline of daily logon counts per user over 30 days, then identifies users whose logon count in the last day exceeds 2 standard deviations above the mean. Option C is correct. Option A is incorrect because it counts logons, not failed logons. Option B is incorrect because it compares to the user's own baseline, not peers. Option D is incorrect because it does not filter by location.

Answer

Detect brute force attacks by correlating multiple users from the same IP.

Answer

Identify logons from unusual geographic locations.

Answer

Identify users with failed logon attempts exceeding a threshold.

Question 9

You are threat hunting for signs of Microsoft 365 mailbox compromise. Which hunting query in Microsoft 365 Defender would be most effective for identifying suspicious mailbox forwarding rules?

Accepted Answer

EmailEvents | where EmailAction == 'Forward'. Mailbox forwarding rules are captured in the EmailEvents table. Option A is correct because it filters for forwarding actions. Option B is incorrect because EmailPostDeliveryEvents is for post-delivery actions. Option C is incorrect because DeviceEvents is for devices. Option D is incorrect because AlertInfo is for alerts, not raw events.

Answer

DeviceEvents | where ActionType contains 'Mailbox'

Answer

AlertInfo | where Title contains 'forward'

Answer

EmailPostDeliveryEvents | where Action == 'Forward'

Question 10

During a threat hunt in Microsoft Sentinel, you find a series of suspicious sign-ins to Microsoft Entra ID from an IP address known to be associated with a threat actor. Which entity should you pivot on to investigate further?

Accepted Answer

IP address. The IP address is the key entity linking the sign-ins. Option C is correct. Option A is incorrect because the user is a target, not the pivot. Option B is incorrect because the device may be compromised but is not the initial pivot. Option D is incorrect because the application is secondary.

Answer

User account

Answer

Application

Answer

Device

Question 11

Refer to the exhibit. The KQL query is used for threat hunting in Microsoft Defender XDR. What is the most likely scenario this query is designed to detect?

Accepted Answer

Ransomware dropping executables on desktops and spreading via SMB. The query looks for .scr files (screensaver, but also used to disguise executables) with names matching 8 lowercase letters on the desktop, and correlates with SMB connections to private IPs. Option A is correct because ransomware often drops executables on desktops and spreads via SMB. Option B is incorrect because the file is on the desktop, not in startup. Option C is incorrect because no registry events are involved. Option D is incorrect because the file is .scr, not .lnk.

Answer

Persistence mechanism via startup folder

Answer

Registry modification to disable security tools

Answer

Phishing campaign delivering .lnk files

Question 12

You are a SOC analyst using Microsoft Sentinel. You need to create a hunting query that searches for unusual outbound RDP connections from workstations. Which KQL operators or functions would be most essential for this query?

Accepted Answer

DeviceNetworkEvents and where LocalPort == 3389 and RemoteIPType == 'Public'. Hunting for outbound RDP requires identifying connections on port 3389 from workstations. Option B is correct because DeviceNetworkEvents includes network connections and port information. Option A is incorrect because DeviceLogonEvents is for logon sessions. Option C is incorrect because DeviceProcessEvents is for processes. Option D is incorrect because DeviceEvents may not include network details.

Answer

DeviceProcessEvents and where ProcessCommandLine contains 'mstsc'

Answer

DeviceLogonEvents and where LogonType == 'RemoteInteractive'

Answer

DeviceEvents and where ActionType contains 'RDP'

Question 13

An analyst is reviewing a series of alerts in Microsoft Defender XDR indicating potential lateral movement. Which KQL query in Microsoft Sentinel would best identify anomalous RDP connections to servers not typically accessed remotely?

Accepted Answer

DeviceNetworkEvents | where RemotePort == 3389 | summarize dcount(DestinationIP) by DeviceName | where dcount_DestinationIP > 5. Option D is correct because the `DeviceNetworkEvents` table in Microsoft Defender XDR logs network connections, and filtering for RDP port 3389 with a count of distinct destination IPs over a threshold helps identify unusual RDP patterns. Option A is wrong because `DeviceProcessEvents` logs process creation, not network connections. Option B is wrong because `DeviceLogonEvents` logs authentication events, not network connections. Option C is wrong because `DeviceRegistryEvents` logs registry changes.

Answer

DeviceProcessEvents | where ProcessCommandLine contains '3389'

Answer

DeviceRegistryEvents | where RegistryKey contains 'Remote Desktop'

Answer

DeviceLogonEvents | where LogonType == '10' | summarize dcount(DeviceName) by AccountName

Question 14

You are investigating a potential data exfiltration incident. You notice a user uploading large amounts of data to a cloud storage service that the organization has not approved. Which Microsoft Defender XHR feature would best help you hunt for similar patterns across all users?

Accepted Answer

Advanced hunting in Microsoft Defender XDR. Option B is correct because advanced hunting allows you to write custom KQL queries to detect patterns like large uploads to unapproved cloud storage. Option A is wrong because custom detection rules are for creating alerts based on queries, but the question asks for hunting. Option C is wrong because incident investigation focuses on a single incident, not proactive hunting. Option D is wrong because automation rules automate responses, not hunting.

Answer

Custom detection rules in Microsoft Sentinel

Answer

Incident investigation graph in Microsoft Defender XDR

Answer

Automation rules in Microsoft Sentinel

Question 15

During a threat hunt, you want to identify processes that have made network connections to known malicious IP addresses. Which data source in Microsoft Defender for Endpoint would provide the necessary information?

Accepted Answer

DeviceNetworkEvents. Option C is correct because DeviceNetworkEvents logs network connections including destination IP addresses. Option A is wrong because DeviceProcessEvents logs process creation, not network connections. Option B is wrong because DeviceFileEvents logs file operations. Option D is wrong because DeviceRegistryEvents logs registry changes.

Answer

DeviceFileEvents

Answer

DeviceProcessEvents

Answer

DeviceRegistryEvents

SC-200 Perform threat hunting Practice Test 5 — 15 Questions

Exhibit

SC-200 Perform threat hunting Practice Test 5 — 15 Questions

Exhibit