SC-200 Perform threat hunting Practice Test 6 — 15 Questions

Question 1

An analyst uses this KQL query in Microsoft Sentinel to hunt for potential brute-force attacks. What is the primary purpose of the join operation?

Accepted Answer

To identify accounts that had both a high number of failed logons and at least one successful logon from the same IP. The join operation correlates failed and successful logon events for the same account and source IP. This allows the analyst to identify accounts that experienced many failed logon attempts and eventually a successful logon from the same IP, which is indicative of a brute-force attack. Option A is incorrect because the join does not filter out IPs; it combines data. Option C is incorrect because the query does not compute a ratio of failed to successful logons. Option D is incorrect because the join is not used to remove duplicates; it enriches the data set.

Answer

To filter out IP addresses that have only successful logons

Answer

To calculate the ratio of failed to successful logons for each account

Answer

To remove duplicate entries of account and IP combinations

Question 2

You are hunting for signs of ransomware activity. Which of the following behaviors in Microsoft Defender for Endpoint should you prioritize as a high-confidence indicator?

Accepted Answer

A process encrypting or renaming large numbers of files in rapid succession. Rapid encryption or renaming of large numbers of files is a definitive indicator of ransomware activity. Option A (deleting Volume Shadow Copies) is a common post‑infection step but can also be performed by legitimate disk cleanup utilities, so it is not as high‑confidence. Option C (creating a scheduled task) is a persistence mechanism used by many types of malware, not specific to ransomware. Option D (downloading multiple files) is too generic and could be normal user behavior. Therefore, prioritizing mass file encryption/renaming provides the strongest signal.

Answer

A process deleting Volume Shadow Copies

Answer

A process creating a scheduled task

Answer

A process downloading multiple files from the internet

Question 3

During a threat hunt in Microsoft Sentinel, you find a query that returns a high number of false positives. Which action should you take to refine the hunt?

Accepted Answer

Add additional filters to the query to exclude known benign activity. Adding additional filters to exclude known benign activity directly reduces false positives by narrowing the scope of the query. Option A is wrong because increasing the time range would gather more data, likely increasing false positives. Option B is wrong because creating a scheduled alert rule is for ongoing detection, not for refining an ad-hoc hunt. Option C is wrong because removing columns only changes the displayed fields, not the data matched, so it does not affect false positive counts.

Answer

Increase the query time range to gather more data

Answer

Create a scheduled alert rule based on the query

Answer

Remove columns from the result set to simplify analysis

Question 4

Refer to the exhibit. A custom detection rule in Microsoft Sentinel uses this JSON definition. An analyst notices that the rule is generating alerts for legitimate administrative scripts launched from File Explorer. What is the best way to reduce false positives while retaining detection of malicious Office-based PowerShell launches?

Accepted Answer

Add an additional filter to exclude PowerShell executions from specific administrative user accounts. Adding conditions to exclude known administrative scenarios (e.g., specific user accounts) reduces false positives without removing the parent process filter entirely. Option B is wrong because removing the parent process filter would broaden detection, likely increasing false positives. Option C is wrong because lowering severity does not reduce false positives. Option D is wrong because increasing time range does not help.

Answer

Increase the query time range to 30 days

Answer

Change the severity to Informational to suppress alerts

Answer

Remove the parent process filter and rely only on FileName == 'powershell.exe'

Question 5

Which TWO of the following are valid methods to perform threat hunting in Microsoft Sentinel? (Choose TWO.)

Accepted Answer

Create and save custom KQL queries in the Hunting blade. Options A and B are correct. A: Custom KQL queries can be created and saved in the Hunting blade. B: The Hunting blade provides built-in hunting queries. Option C is incorrect because automated response rules are for incident response, not proactive threat hunting. Option D is incorrect because Workbooks are for visualization, not interactive hunting queries. Option E is incorrect because Playbooks are for automated responses, not scheduling queries; scheduled analytics rules handle periodic query execution.

Answer

Configure automated response rules to detect threats

Answer

Use Workbooks to visualize data and identify anomalies

Answer

Create a Playbook to automatically run queries on a schedule

Question 6

Which THREE of the following are key considerations when designing a threat hunting program in Microsoft Defender XDR and Microsoft Sentinel? (Choose THREE.)

Accepted Answer

Understanding the data schema and available tables in the advanced hunting schema. Options A, B, and E are correct. A: Understanding the data schema and available tables ensures you use the right tables. B: Operational security (OpSec) is critical to avoid alerting adversaries during manual hunting. E: Data retention policies affect how far back you can hunt. Option C is wrong because multi-factor authentication is an identity protection measure, not a hunting consideration. Option D is wrong because hunting often requires custom queries, not just built-in detection rules.

Answer

Implementing multi-factor authentication for all users

Answer

Using only built-in detection rules to identify threats

Question 7

Which TWO of the following KQL functions are commonly used in threat hunting queries to identify outliers? (Choose TWO.)

Accepted Answer

percentile(). Options B and E are correct. B: `percentile()` helps identify outliers by finding values above a certain threshold. E: `bin()` with `summarize` aggregates data over time, enabling anomaly detection. Option A is wrong because `where()` filters rows, not for outlier detection. Option C is wrong because `project()` selects columns. Option D is wrong because `extend()` adds calculated columns, not for outlier identification.

Answer

where()

Answer

project()

Answer

extend()

Question 8

An analyst runs this PowerShell script to query Microsoft Sentinel data. The query returns no results. What is the most likely reason?

Accepted Answer

No events matched the specific combination of process name and command line in the last 7 days. The query syntax is valid (e.g., using where and summarize appropriately), the API endpoint and timestamp filter are standard for Microsoft Sentinel queries. The most probable reason for no results is that no events with rundll32.exe and javascript in the command line occurred within the specified 7-day window. Options A, B, and D describe issues that would typically cause errors, not just empty results, making C the most likely explanation.

Answer

The timestamp filter is invalid; it should use TimeGenerated instead of Timestamp

Answer

The query syntax is incorrect; summarize cannot be used after where

Answer

The API endpoint URL is incorrect; it should be /v2/workspaces

Question 9

Which Microsoft Sentinel feature allows you to query data across multiple workspaces in a single KQL query?

Accepted Answer

The workspace() function in KQL. The `workspace()` function in KQL allows you to include data from multiple Log Analytics workspaces in a single query. Option A is incorrect because the `union` operator with workspace names is not a valid cross-workspace query method; `union` combines tables within the same workspace. Option B is incorrect because the `externaldata` operator is used to query data from external storage, not other workspaces. Option D is incorrect because the `join` operator merges rows from tables within the same workspace, not across workspaces.

Answer

The union operator with workspace names

Answer

The externaldata operator with workspace URLs

Answer

The join operator with workspace identifiers

Question 10

You are conducting a threat hunt in Microsoft Defender XDR and want to identify devices that have recently communicated with a known C2 server IP address. Which advanced hunting table should you query?

Accepted Answer

DeviceNetworkEvents. EviceNetworkEvents (Option A) because this table contains network connection events including destination IP addresses, ports, and protocols. It is used to identify network communications with suspicious IPs such as C2 servers. DeviceProcessEvents (Option D) is for process creation events, DeviceLogonEvents (Option C) is for authentication events, and DeviceFileEvents (Option B) is for file system events. Only DeviceNetworkEvents provides the necessary network traffic information for threat hunting in Microsoft Defender XDR.

Answer

DeviceFileEvents

Answer

DeviceLogonEvents

Answer

DeviceProcessEvents

Question 11

A security analyst is performing threat hunting in Microsoft Sentinel and wants to identify anomalous outbound network traffic from a compromised virtual machine. Which data source should be prioritized for this hunt?

Accepted Answer

Azure Network Watcher flow logs. Azure Network Watcher flow logs provide detailed information about IP traffic through Azure networks, making them ideal for detecting anomalous outbound traffic patterns. Option A (Azure Activity Log) focuses on control plane events, not network flows. Option C (Windows Event Logs) is for host-level events, not network traffic. Option D (Azure AD sign-in logs) is for authentication events.

Answer

Azure Activity Log

Answer

Windows Event Logs (Security, System)

Answer

Microsoft Entra ID sign-in logs

Question 12

During a threat hunt in Microsoft Defender XDR, an analyst discovers that a specific user account has been executing unusual PowerShell commands from a non-corporate device. The analyst wants to investigate the timeline of these activities across all Microsoft 365 services. Which advanced hunting schema should be used to correlate these events?

Accepted Answer

IdentityLogonEvents. The IdentityLogonEvents table in advanced hunting captures authentication events, including device and user details, which is essential for correlating activities across services. Option A (DeviceEvents) is for endpoint processes, not logon correlation. Option B (CloudAppEvents) covers cloud app activities but not logon context. Option C (EmailEvents) is for email tracking.

Answer

DeviceEvents

Answer

CloudAppEvents

Answer

EmailEvents

Question 13

A threat hunter in Microsoft Sentinel wants to detect attempts to disable security logging on Windows servers using a KQL query. Which Windows Event ID should the query filter on to capture security log clearing events?

Accepted Answer

1102. Event ID 1102 in the Windows Security log indicates the security log was cleared, which is a common technique used by attackers to cover their tracks. Option A (4688) is for process creation. Option B (4624) is for successful logon. Option C (5145) is for network share access. Therefore, only Option D (1102) correctly captures security log clearing events.

Answer

4688

Answer

4624

Answer

5145

Question 14

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. During a threat hunt, you find that a user accessed a sensitive SharePoint site from an anonymous IP address. Which hunting method would best identify all users who accessed the same site from similar anonymous IPs?

Accepted Answer

Query CloudAppEvents in Advanced hunting for the SharePoint site URL and filter by IP category 'AnonymousProxy'. Using KQL to query CloudAppEvents for the specific SharePoint site and filtering by IP address categories (e.g., AnonymousProxy) is the most direct method. Option D (Azure AD sign-in logs) may not include SharePoint site-level access. Option B (Microsoft Defender for Endpoint) is for endpoint activities. Option C (Microsoft Purview) focuses on data classification and governance.

Answer

Query DeviceEvents for network connections from the anonymous IP

Answer

Use Microsoft Purview to scan for sensitive data accessed from anonymous IPs

Answer

Search Azure AD sign-in logs for the same IP

Question 15

You are threat hunting in Microsoft Sentinel and have enabled UEBA. You want to detect a possible privilege escalation where a user creates a new user account and adds it to a privileged role within minutes. Which UEBA anomaly type should you investigate?

Accepted Answer

Mass role assignment changes. UEBA detects 'Mass role assignment changes' as an anomaly that could indicate privilege escalation. Option A (Unusual file access) is for data exfiltration. Option B (Impossible travel) is for geographic anomalies. Option D (Anomalous sign-in) focuses on authentication.

Answer

Unusual file access

Answer

Impossible travel

Answer

Anomalous sign-in