SC-200 Perform threat hunting Practice Test 6 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to create a hunting query that finds users who have accessed a high number of distinct Azure resources within a short time frame, which may indicate credential theft. Which KQL query would be most effective?

Accepted Answer

AzureActivity | where TimeGenerated > ago(1d) | summarize dcount(Resource) by Caller, bin(TimeGenerated, 1h) | where dcount_Resource > 20. Option D is correct because it uses the AzureActivity table to count distinct resources per user per hour, filtering for those with more than 20 resources. Option A is wrong because it uses a 1-minute bucket, too granular for meaningful hunting. Option B is wrong because it counts operations, not distinct resources. Option C is wrong because it counts distinct operation names, not resources.

Answer

AzureActivity | summarize dcount(Resource) by bin(TimeGenerated, 1m), Caller

Answer

AzureActivity | summarize count() by Caller | where count_ > 20

Answer

AzureActivity | summarize dcount(OperationName) by Caller, bin(TimeGenerated, 1h) | where dcount_OperationName > 20

Question 2

You are hunting for signs of credential dumping using Mimikatz. Which process events in Microsoft Defender for Endpoint would most likely indicate this activity?

Accepted Answer

A process opening lsass.exe with access to process memory (e.g., PROCESS_VM_READ). Option B is correct because Mimikatz often injects into LSASS to dump credentials, so detecting a process opening LSASS with specific access flags (e.g., PROCESS_VM_READ) is a key indicator. Option A is wrong because svchost.exe is not typically used for credential dumping. Option C is wrong because powershell.exe alone is generic. Option D is wrong because cmd.exe is generic.

Answer

A process named powershell.exe making network connections to an external IP

Answer

A process named svchost.exe spawning from explorer.exe

Answer

A process named cmd.exe executing whoami

Question 3

An analyst uses this KQL query in Microsoft Sentinel to hunt for potential brute-force attacks. What is the primary purpose of the join operation?

Accepted Answer

To identify accounts that had both a high number of failed logons and at least one successful logon from the same IP. Option C is correct because the join is used to correlate failed and successful logons from the same account and IP, which helps identify accounts that eventually succeeded after many failures, a classic brute-force pattern. Option A is wrong because the query does not filter out IPs with only successes. Option B is wrong because the join is not filtering anything; it's enriching. Option D is wrong because the query does not calculate a ratio.

Answer

To filter out IP addresses that have only successful logons

Answer

To calculate the ratio of failed to successful logons for each account

Answer

To remove duplicate entries of account and IP combinations

Question 4

You are hunting for signs of ransomware activity. Which of the following behaviors in Microsoft Defender for Endpoint should you prioritize as a high-confidence indicator?

Accepted Answer

A process encrypting or renaming large numbers of files in rapid succession. Option A is correct because mass file encryption or renaming is a direct sign of ransomware. Option B is wrong because while shadow copy deletion is common after ransomware, it can also be done by legitimate tools. Option C is wrong because large file downloads can be benign. Option D is wrong because scheduled task creation is common for persistence but not specific to ransomware.

Answer

A process deleting Volume Shadow Copies

Answer

A process creating a scheduled task

Answer

A process downloading multiple files from the internet

Question 5

During a threat hunt in Microsoft Sentinel, you find a query that returns a high number of false positives. Which action should you take to refine the hunt?

Accepted Answer

Add additional filters to the query to exclude known benign activity. Option C is correct because tuning the query by adding more conditions reduces false positives. Option A is wrong because increasing the time range would likely increase false positives. Option B is wrong because removing columns does not affect false positives. Option D is wrong because creating an alert rule is for ongoing detection, not for refining the hunt.

Answer

Increase the query time range to gather more data

Answer

Create a scheduled alert rule based on the query

Answer

Remove columns from the result set to simplify analysis

Question 6

Refer to the exhibit. A custom detection rule in Microsoft Sentinel uses this JSON definition. An analyst notices that the rule is generating alerts for legitimate administrative scripts launched from File Explorer. What is the best way to reduce false positives while retaining detection of malicious Office-based PowerShell launches?

Accepted Answer

Add an additional filter to exclude PowerShell executions from specific administrative user accounts. Option B is correct because adding conditions to exclude known administrative scenarios (e.g., specific user accounts or command-line patterns) reduces false positives without removing the parent process filter entirely. Option A is wrong because removing the parent process filter would broaden detection, likely increasing false positives. Option C is wrong because lowering severity does not reduce false positives. Option D is wrong because increasing time range does not help.

Answer

Increase the query time range to 30 days

Answer

Change the severity to Informational to suppress alerts

Answer

Remove the parent process filter and rely only on FileName == 'powershell.exe'

Question 7

Which TWO of the following are valid methods to perform threat hunting in Microsoft Sentinel? (Choose TWO.)

Accepted Answer

Create and save custom KQL queries in the Hunting blade. Options A and D are correct. A: The Hunting blade provides a list of built-in hunting queries. D: Custom KQL queries can be created and saved. Option B is wrong because Playbooks are for automated response, not hunting. Option C is wrong because Workbooks are for visualization, not interactive hunting.

Answer

Configure automated response rules to detect threats

Answer

Use Workbooks to visualize data and identify anomalies

Answer

Create a Playbook to automatically run queries on a schedule

Question 8

Which THREE of the following are key considerations when designing a threat hunting program in Microsoft Defender XDR and Microsoft Sentinel? (Choose THREE.)

Accepted Answer

Understanding the data schema and available tables in the advanced hunting schema. Options A, B, and E are correct. A: Data retention policies affect how far back you can hunt. B: Understanding data sources ensures you use the right tables. E: OpSec is critical to avoid alerting adversaries. Option C is wrong because hunting often requires custom queries, not just built-in rules. Option D is wrong because MFA is an identity protection measure, not a hunting consideration.

Answer

Implementing multi-factor authentication for all users

Answer

Using only built-in detection rules to identify threats

Question 9

Which TWO of the following KQL functions are commonly used in threat hunting queries to identify outliers? (Choose TWO.)

Accepted Answer

percentile(). Options B and D are correct. B: `percentile()` helps find values above a certain threshold. D: `bin()` with `summarize` is used to aggregate data over time for anomaly detection. Option A is wrong because `extend()` adds columns, not for outlier detection. Option C is wrong because `project` selects columns.

Answer

where()

Answer

project()

Answer

extend()

Question 10

An analyst runs this PowerShell script to query Microsoft Sentinel data. The query returns no results. What is the most likely reason?

Accepted Answer

No events matched the specific combination of process name and command line in the last 7 days. Option B is correct because the query uses `rundll32.exe` with `javascript` in the command line, which is an uncommon but known technique for executing JavaScript via rundll32. Option A is wrong because the API endpoint is correct for Log Analytics. Option C is wrong because the date range is valid. Option D is wrong because 7-day range is valid.

Answer

The timestamp filter is invalid; it should use TimeGenerated instead of Timestamp

Answer

The query syntax is incorrect; summarize cannot be used after where

Answer

The API endpoint URL is incorrect; it should be /v2/workspaces

Question 11

Which Microsoft Sentinel feature allows you to query data across multiple workspaces in a single KQL query?

Accepted Answer

The workspace() function in KQL. Option A is correct because the `workspace()` function in KQL allows cross-workspace queries. Option B is wrong because cross-resource queries use `workspace()`, not `union()`. Option C is wrong because `join` is used to combine tables, not workspaces. Option D is wrong because `externaldata` is for external data sources.

Answer

The union operator with workspace names

Answer

The externaldata operator with workspace URLs

Answer

The join operator with workspace identifiers

Question 12

You are conducting a threat hunt in Microsoft Defender XDR and want to identify devices that have recently communicated with a known C2 server IP address. Which advanced hunting table should you query?

Accepted Answer

DeviceNetworkEvents. Option D is correct because `DeviceNetworkEvents` contains network connection information including destination IPs. Option A is wrong because `DeviceProcessEvents` is for processes. Option B is wrong because `DeviceLogonEvents` is for logons. Option C is wrong because `DeviceFileEvents` is for files.

Answer

DeviceFileEvents

Answer

DeviceLogonEvents

Answer

DeviceProcessEvents

Question 13

A security analyst is performing threat hunting in Microsoft Sentinel and wants to identify anomalous outbound network traffic from a compromised virtual machine. Which data source should be prioritized for this hunt?

Accepted Answer

Azure Network Watcher flow logs. Azure Network Watcher flow logs provide detailed information about IP traffic through Azure networks, making them ideal for detecting anomalous outbound traffic patterns. Option A (Azure Activity Log) focuses on control plane events, not network flows. Option C (Windows Event Logs) is for host-level events, not network traffic. Option D (Azure AD sign-in logs) is for authentication events.

Answer

Azure Activity Log

Answer

Windows Event Logs (Security, System)

Answer

Microsoft Entra ID sign-in logs

Question 14

During a threat hunt in Microsoft Defender XDR, an analyst discovers that a specific user account has been executing unusual PowerShell commands from a non-corporate device. The analyst wants to investigate the timeline of these activities across all Microsoft 365 services. Which advanced hunting schema should be used to correlate these events?

Accepted Answer

IdentityLogonEvents. The IdentityLogonEvents table in advanced hunting captures authentication events, including device and user details, which is essential for correlating activities across services. Option B (DeviceEvents) is for endpoint processes, not logon correlation. Option C (EmailEvents) is for email tracking. Option D (CloudAppEvents) covers cloud app activities but not logon context.

Answer

DeviceEvents

Answer

CloudAppEvents

Answer

EmailEvents

Question 15

A threat hunter in Microsoft Sentinel wants to detect attempts to disable security logging on Windows servers using a KQL query. Which Windows Event ID should the query filter on to capture security log clearing events?

Accepted Answer

1102. Event ID 1102 in Windows Security log indicates the security log was cleared, which is a common technique used by attackers to cover tracks. Option A (4688) is for process creation. Option B (4624) is for successful logon. Option D (5145) is for network share access.

Answer

4688

Answer

4624

Answer

5145