SC-200 Perform threat hunting Practice Test 7 — 15 Questions

Question 1

During a threat hunting exercise in Microsoft Sentinel, you want to identify all cloud application events where a user accessed a resource from an IP address not previously associated with that user. Which KQL operator should you use to compare current access patterns with a baseline of known IPs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

join. The KQL join operator is used to correlate two datasets on a common key — here, current cloud app access events joined against a baseline table of known user-to-IP mappings, so you can surface rows where the IP is not in the baseline. This is the standard pattern for 'new IP for this user' detections in Microsoft Sentinel.

Answer

lookup

Answer

summarize

Answer

union

Question 2

During a threat hunt, you identify a suspicious process execution chain in Microsoft Defender for Endpoint: `powershell.exe` spawned `cmd.exe` which then executed `rundll32.exe`. To investigate the parent-child relationships, which KQL statement should you use in Advanced Hunting?

Accepted Answer

DeviceProcessEvents | where ProcessChain has_all ("powershell.exe", "cmd.exe", "rundll32.exe"). Advanced Hunting in Microsoft Defender for Endpoint includes a `ProcessChain` column in `DeviceProcessEvents` that contains the full sequence of parent processes leading to the current process. Using `has_all` checks that all three executables appear in the chain in order, directly matching the suspicious execution pattern. Option A only checks the immediate parent (InitiatingProcessFileName), so it would miss scenarios where `cmd.exe` is not the direct parent of `rundll32.exe`. Option C summarizes by chain but does not filter for the specific chain. Option D joins on DeviceId without constraining parent-child relationships, leading to irrelevant results.

Answer

DeviceProcessEvents | where FileName == "rundll32.exe" and InitiatingProcessFileName == "cmd.exe"

Answer

DeviceProcessEvents | summarize by ProcessChain

Answer

DeviceProcessEvents | where FileName == "powershell.exe" | join kind=inner DeviceProcessEvents on $left.DeviceId == $right.DeviceId

Question 3

You are reviewing a custom analytics rule in Microsoft Sentinel. The rule is enabled but you notice that no alerts have been generated even though there are many matching events. What is the most likely cause?

Accepted Answer

The triggerThreshold of 5 requires at least 5 matching events in each hour.. The rule suppresses alerts for 5 hours after an alert is generated. Since suppression is enabled (suppressionEnabled: true? Actually the value is false, but the duration is set. Wait, suppressionEnabled is false, so suppression is disabled. However, the queryFrequency and queryPeriod are both 1 hour, and triggerThreshold is 5. If there are many matching events, the threshold might not be met if events are spread out. But the exhibit shows suppressionEnabled: false, so suppression is not the issue. The most likely cause is that the rule has a triggerThreshold of 5, meaning it requires at least 5 events in the query period. If there are fewer than 5, no alert is generated.

Answer

The rule is not associated with a data connector.

Answer

The queryPeriod is too short to capture events.

Answer

The rule is suppressed due to suppressionDuration of 5 hours.

Question 4

A threat hunter runs the above KQL query in Microsoft Defender Advanced Hunting. What is the primary purpose of this query?

Accepted Answer

Detect logon attempts from new IP addresses for existing users.. The query uses a pattern that identifies logon events where the source IP is new for a given user account, typically by comparing against historical logon data (e.g., using 'summarize' or 'join' with a baseline of previously seen IPs per user). This is a classic threat hunting technique to surface anomalous authentication activity that could indicate credential compromise or impossible travel. Option A correctly captures this intent: detecting logons from IPs that are new for existing users, not just new IPs globally.

Answer

Create a list of all unique logon events in the last day.

Answer

Identify users who have not logged in within the past 30 days.

Answer

Find all logon events from IPs that have never been seen before.

Question 5

Which THREE techniques are commonly used in threat hunting within Microsoft Defender XDR to detect privilege escalation?

Accepted Answer

Token manipulation. Token manipulation (C) is a core privilege-escalation technique in Windows, where an attacker duplicates, impersonates, or steals a primary or impersonation token (e.g., via DuplicateTokenEx or ImpersonateLoggedOnUser) to run code under a higher-integrity or more privileged account, making it a key hunting signal in Microsoft Defender XDR. Access token manipulation (D) is the related MITRE ATT&CK sub-technique (T1134.001) covering theft or forgery of access tokens, including SeDebugPrivilege abuse and token impersonation, which Defender XDR surfaces through advanced hunting queries over DeviceProcessEvents and related tables. Process injection (E) is also a common privilege-escalation and defense-evasion technique (T1055), where code is injected into a higher-privileged process such as lsass.exe or a SYSTEM-owned service to inherit its token and integrity level, and Defender XDR detects it via behaviors like CreateRemoteThread, WriteProcessMemory, and anomalous cross-process access. Spearphishing attachment (A) is an initial-access technique (T1566.001), not a privilege-escalation method, and data exfiltration (B) is a collection/exfiltration-stage activity (TA0010), so neither belongs in a list of privilege-escalation hunting techniques.

Answer

Spearphishing attachment

Answer

Data exfiltration

Question 6

You are conducting a threat hunt to find evidence of credential dumping on Windows servers. Which event ID in Windows Security Event Log (SecurityEvent) is most indicative of LSASS process access?

Accepted Answer

4656 (Handle to an object requested). Event ID 4656 (Handle to an object requested) is generated when a handle is requested for an object, including LSASS process access. When tools like Mimikatz or ProcDump access LSASS memory for credential dumping, they request a handle to the LSASS process, generating 4656 events (often paired with 4658 when the handle is closed). This makes 4656 the most indicative event ID for detecting LSASS process access in Windows Security logs.

Answer

4688 (Process creation)

Answer

4672 (Special privileges assigned)

Answer

4624 (Logon)

Question 7

During a threat hunt, you find a PowerShell script that decodes a base64-encoded command and executes it. Which MITRE ATT&CK technique is this behavior most associated with?

Accepted Answer

T1027 (Obfuscated Files or Information). Base64 encoding is a form of obfuscation used to hide malicious scripts from casual inspection and simple string-based detection. MITRE ATT&CK T1027 (Obfuscated Files or Information) covers techniques like encoding, encryption, and compression to make artifacts difficult to analyze. While PowerShell (T1059.001) is the execution method, the core behavior described is obfuscation.

Answer

T1059.001 (PowerShell)

Answer

T1055 (Process Injection)

Answer

T1003 (Credential Dumping)

Question 8

Your threat hunt reveals a series of failed logon attempts from a single IP address across multiple user accounts. Which Microsoft Sentinel analytic rule template is best suited to alert on this brute-force pattern?

Accepted Answer

Password spray attack. Failed logon attempts from a single IP spread across multiple user accounts is the signature pattern of a password-spray attack, where an attacker tries one or a few common passwords against many accounts to stay under per-account lockout thresholds. A classic brute-force pattern instead shows many failed attempts concentrated against a single account.

Answer

Malware detected in network traffic

Answer

Brute force attack against a user account

Answer

Anomalous logon location

Question 9

You are threat hunting for signs of Kerberoasting in Microsoft Sentinel. Which combination of events indicates that a service account's Kerberos ticket was requested and then used?

Accepted Answer

Event ID 4769 (Kerberos Service Ticket Request) followed by Event ID 4624 (An account was logged on). Kerberoasting involves an attacker requesting a Kerberos service ticket (TGS) for a service account with a weak password, then cracking it offline. Event ID 4769 logs the Kerberos service ticket request, and the subsequent Event ID 4624 (logon) indicates the ticket was actually used to authenticate, confirming exploitation. This pairing is the classic detection pattern in Microsoft Sentinel for Kerberoasting activity.

Answer

Event ID 4770 (Kerberos Ticket Renewal) followed by Event ID 4634 (Logoff)

Answer

Event ID 4740 (Account Lockout) followed by Event ID 4625 (Failed Logon)

Answer

Event ID 4768 (Kerberos Authentication Ticket) followed by Event ID 4776 (Credential Validation)

Question 10

You are using the Microsoft Sentinel Threat Hunting experience to create a new hunting query. Which tab should you select to bookmark a suspicious event for further investigation?

Accepted Answer

Bookmarks. The Bookmarks tab allows you to save and annotate suspicious events for further investigation. Option A (Results) displays query results but does not offer bookmarking. Option B (Queries) is for managing saved queries, not bookmarking events. Option D (Entities) shows entity pages, unrelated to bookmarking.

Answer

Results

Answer

Queries

Answer

Entities

Question 11

Which TWO KQL operators are most useful for threat hunting lateral movement in Microsoft Defender XDR? (Select two.)

Accepted Answer

join. Option C (join) is correct because lateral movement hunting requires correlating activity across different tables or hosts, such as linking DeviceLogonEvents with DeviceProcessEvents or matching a source host to a destination host, and the join operator is the KQL mechanism for combining rows from two or more tables on a matching key. Option E (where) is correct because filtering is essential to isolate suspicious lateral movement indicators, such as filtering for remote logons (LogonType == 3 or 10), specific accounts, or known compromised hosts, and where applies row-level predicates to narrow results to relevant events. Option A (project) is not among the correct answers because it only selects or renames columns and does not by itself correlate or filter for lateral movement. Option B (summarize) is not marked correct because although it aggregates data, it is not one of the two operators most directly used to correlate and filter lateral movement activity in this scenario. Option D (search) is not marked correct because it performs a broad free-text search across tables and is less precise than targeted filtering and correlation for lateral movement hunting.

Answer

project

Answer

summarize

Answer

search

Question 12

You are a security analyst at Contoso. You manage a Microsoft Sentinel workspace with Microsoft Defender for Cloud Apps, Microsoft Defender for Endpoint, and Microsoft Entra ID (formerly Azure AD) data connectors. You are performing a proactive threat hunt for potential data exfiltration via external file sharing services like Dropbox and Google Drive. Your organization blocks these services on managed devices but users can access them from personal devices. You want to detect when users log in to these services from a corporate network using Microsoft Entra ID credentials. You have access to CloudAppEvents, AADSignInEventsBeta, and DeviceNetworkEvents tables in Microsoft Defender XDR advanced hunting. You need to create a hunting query that identifies sign-ins to external file sharing apps from corporate IP ranges. The query should also exclude sign-ins from known good service accounts. Which approach should you take?

Accepted Answer

Join AADSignInEventsBeta with CloudAppEvents on AccountUpn, filter for app categories containing 'file sharing', and where IPAddress is in the corporate range.. The correct approach joins AADSignInEventsBeta (which contains Entra ID sign-in events with IP addresses and account UPNs) with CloudAppEvents (which contains app activity including app categories like file sharing) on AccountUpn, then filters for file-sharing app categories and corporate IP ranges. This correlates identity sign-in data with app usage to detect the specific scenario of users signing in to external file-sharing services from corporate IPs. It also allows exclusion of known good service accounts.

Answer

Use DeviceNetworkEvents to find connections to file sharing service IPs, then correlate with AADSignInEventsBeta by user.

Answer

Filter CloudAppEvents for app categories 'file sharing' and where IP is in corporate range, then join with DeviceInfo for device ownership.

Answer

Use DeviceNetworkEvents to find high-volume outbound traffic to cloud storage provider IP ranges, then manually investigate users.

Question 13

You are threat hunting in Microsoft Defender XDR for signs of Kerberoasting. Which hunting query would be most effective in identifying Kerberoasting activity?

Accepted Answer

IdentityQueryEvents | where QueryTarget like 'TGS' | summarize count() by InitiatingAccount, IPAddress | where count_ > 10. Kerberoasting involves requesting Kerberos service tickets (TGS) for service accounts and then cracking them offline. The most effective hunting query looks for a high volume of TGS requests from a single account or IP, which is characteristic of Kerberoasting. Option B uses IdentityQueryEvents to count TGS queries per initiating account and IP, filtering for more than 10 — exactly the pattern of enumeration and ticket requests seen in Kerberoasting.

Answer

IdentityDirectoryEvents | where AccountDomain == 'Service Accounts'

Answer

IdentityLogonEvents | where Application == 'Kerberos' and Result == 'Failed'

Answer

IdentityLogonEvents | where LogonType == 'Failed'

Question 14

Refer to the exhibit. The KQL query is used in a threat hunting campaign. Which of the following best describes the hunting activity this query is designed to detect?

Accepted Answer

Macro-based PowerShell execution from Office documents. The query is designed to detect macro-based PowerShell execution spawned from Office applications, a classic initial-access technique where malicious macros in Word or Excel launch PowerShell. This pattern — Office parent process spawning PowerShell — is a hallmark of phishing-delivered macro malware. The hunting query correlates process creation events where the parent is an Office binary and the child is PowerShell.

Answer

Encoded PowerShell commands executed from the command line

Answer

Lateral movement using PowerShell remoting

Answer

Data exfiltration via PowerShell over HTTP

Question 15

Which TWO of the following KQL operators are most useful when building hunting queries to detect anomalous activities over time?

Accepted Answer

summarize. Option B, summarize, is correct because it aggregates events into time buckets (for example, by bin(TimeGenerated, 1h)) and computes statistics such as count(), avg(), or dcount(), which is exactly how you establish a baseline and surface deviations over time in a hunting query. Option D, make_list, is correct because it collects the individual values of a field into a dynamic array, letting you preserve the raw sequence of events or entities within each summarized group so you can inspect what actually happened during an anomalous period. Option A, where, is a filtering operator that narrows rows by a predicate but performs no temporal aggregation or anomaly detection on its own. Option C, project, only selects, renames, or drops columns and does not analyze activity over time. Option E, extend, merely adds computed columns to each row and, without summarize or make_list, cannot reveal time-based anomalies.

Answer

where

Answer

project

Answer

extend