SC-200 Perform threat hunting Practice Test 7 — 15 Questions

Question 1

A threat hunter is using Microsoft Defender XDR Advanced hunting to find evidence of credential dumping. Which table should be queried to detect use of tools like Mimikatz?

Accepted Answer

DeviceEvents. The DeviceEvents table in Microsoft Defender XDR Advanced hunting captures events from security sensors, including detection of credential dumping tools like Mimikatz. CloudAppEvents (Option A) covers cloud application activities, not local credential dumping. IdentityLogonEvents (Option C) focuses on authentication logon events. EmailEvents (Option D) is for email-related events. Therefore, DeviceEvents is the correct table to query.

Answer

CloudAppEvents

Answer

IdentityLogonEvents

Answer

EmailEvents

Question 2

During a threat hunt, you find an alert for a suspicious PowerShell script that encoded a payload. You want to decode the script to understand its intent. Which Microsoft Sentinel feature can assist with this task?

Accepted Answer

Hunting blade with KQL using base64_decode_tostring(). Sentinel's Entity behavior analytics can provide context, but for decoding, using a custom notebook or Azure Functions with PowerShell is more direct. However, the question asks for a feature; the correct answer is to use the 'Hunting' blade with a custom KQL query that uses base64_decode_tostring() function. Option A (Playbooks) are for automated response. Option B (Workbooks) for visualization. Option D (Analytics rules) for detection.

Answer

Playbooks

Answer

Workbooks

Answer

Analytics rules

Question 3

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You are hunting for signs of a possible Kerberos Golden Ticket attack. Which advanced hunting table should you query to detect anomalous Kerberos ticket-granting ticket (TGT) requests?

Accepted Answer

IdentityDirectoryEvents. IdentityDirectoryEvents captures domain controller events, including Kerberos authentication details. Option A (IdentityLogonEvents) is for user logons. Option B (DeviceEvents) for endpoint processes. Option D (CloudAppEvents) for cloud apps.

Answer

IdentityLogonEvents

Answer

DeviceEvents

Answer

CloudAppEvents

Question 4

While threat hunting in Microsoft Defender for Cloud Apps, you notice a user has an unusually high number of failed login attempts from a single IP address. What is the most effective next step to determine if this is a brute-force attack?

Accepted Answer

Investigate the IP address in the Microsoft Defender for Cloud Apps Activity log to review all failed attempts. The most direct method is to investigate the IP address in the Microsoft Defender for Cloud Apps Activity log by filtering for that IP and reviewing the failed attempts. Option A (Immediately block the IP) is premature without confirming the pattern. Option C (Creating an anomaly detection policy) is for future detection, not for immediate analysis. Option D (Checking the user's device for malware) is not relevant for cloud app access failures.

Answer

Immediately block the IP address

Answer

Create a new anomaly detection policy for that user

Answer

Check the user's device for malware

Question 5

The KQL query above is used in a threat hunt. What is the most likely scenario this query is designed to detect?

Accepted Answer

Hunting for code execution via rundll32.exe loading JavaScript. The query detects PowerShell spawning rundll32.exe with command line containing 'javascript:', which indicates code execution via rundll32 loading JavaScript. This is commonly used for bypassing application whitelisting. Option A is incorrect because lateral movement using PsExec would involve different processes like services.exe or smbexec. Option B is incorrect as data exfiltration via FTP would show network connections to FTP servers, not this process creation. Option D is incorrect because regsvr32.exe executing scriptlet files would have a command line with 'scrobj.dll', not 'javascript:' in rundll32.

Answer

Identification of lateral movement using PsExec

Answer

Discovery of data exfiltration using FTP

Answer

Detection of regsvr32.exe being used to execute scriptlet files

Question 6

The exhibit shows a hunting query definition in Microsoft Sentinel. What is the primary issue with this hunting query?

Accepted Answer

The ipv4_lookup function is used incorrectly because it requires a data source parameter. The query uses ipv4_lookup with a static lookup table 'solorigate_ips', but this function expects a parameter for the lookup data source. The correct syntax should reference a table or inline list. Therefore, option D is correct because the ipv4_lookup function is used incorrectly; it requires a data source parameter. Option A is incorrect because the ActionType filter is valid. Option B is incorrect because the query does not need a timestamp filter for this context. Option C is incorrect because the ipv4_lookup function does exist in KQL.

Answer

The ActionType filter is invalid

Answer

The query does not filter by timestamp

Answer

The ipv4_lookup function does not exist in KQL

Question 7

A threat hunter runs the KQL query above in Microsoft Sentinel. What is the main limitation of this query?

Accepted Answer

The query relies on an external data source that may be slow or unavailable. The query uses the externaldata() operator to fetch a list of IP addresses from an external URL. This introduces a dependency on that external source, which may be slow, fail, or be out of date. Option A correctly identifies this limitation. Option B is incorrect because the IdentityLogonEvents table does have an IPAddress column. Option C is incorrect because the let statement is correctly defined with a schema. Option D is incorrect because the with(format='csv') is valid for CSV files.

Answer

The IdentityLogonEvents table does not have an IPAddress column

Answer

The let statement is incorrectly defined because it uses externaldata without a schema

Answer

The with(format="csv") is invalid

Question 8

Which TWO actions are effective when threat hunting for lateral movement using remote desktop protocol (RDP) in Microsoft Defender XDR?

Accepted Answer

Query DeviceNetworkEvents for inbound connections on port 3389. Querying DeviceNetworkEvents for inbound RDP connections (port 3389) helps identify potential lateral movement. Correlating with LogonEvents for successful RDP logins confirms the movement. Option B (reviewing CloudAppEvents) is not directly RDP-related but could indicate lateral movement via cloud apps. Option D (checking for unusual email forwarding rules) is typically for exfiltration, not lateral movement. Option E (searching for SMB file share connections) is more related to file sharing and not specifically RDP lateral movement.

Answer

Review CloudAppEvents for access to cloud apps from multiple IPs

Answer

Check for unusual email forwarding rules

Answer

Search for SMB file share connections

Question 9

Which THREE data sources should be included in a threat hunt to detect data exfiltration via DNS tunneling in Microsoft Sentinel?

Accepted Answer

Network flow logs (e.g., Azure Network Watcher). DNS events (from DNS servers or Azure DNS), network flow logs (to see volume), and Windows Event Logs (if DNS server logs are not directly available) can help detect DNS tunneling. Option B (Azure Key Vault logs) are for secret access. Option E (Microsoft 365 audit logs) are for user activities.

Answer

Azure Key Vault diagnostic logs

Answer

Microsoft 365 audit logs

Question 10

Which THREE actions are recommended when conducting a threat hunt for compromised identities using Microsoft Sentinel UEBA?

Accepted Answer

Search for access to applications the user does not normally use. UEBA is used to detect anomalous behavior; focusing on unusual logon times, multiple failed attempts, and unusual application access are key indicators of compromised identities. Option B (querying DNS logs) is more for network anomalies. Option D (investigating firewall changes) is for network security.

Answer

Query DNS logs for unusual domain resolutions

Answer

Investigate changes to firewall rules

Question 11

During a threat hunt in Microsoft Sentinel, you identify a series of successful logins from an unusual IP address to multiple Azure VM instances. The logins occur outside business hours. Which hunting technique would be most effective to correlate these events with potential lateral movement?

Accepted Answer

Use Microsoft Defender for Cloud Apps to perform session replay of the user's activities during that time.. Session replay in Microsoft Defender for Cloud Apps allows you to reconstruct the user's activities, showing the sequence of events across multiple VMs and identifying lateral movement patterns. Option A is wrong because correlating sign-in logs with Azure activity logs may identify concurrent events but doesn't reveal the step-by-step lateral movement. Option B is wrong because creating an alert rule is a detection mechanism, not a proactive hunting technique for correlating events. Option D is wrong because UEBA detects anomalies based on baselines but does not directly link the logins to lateral movement.

Answer

Run a KQL query that correlates sign-in logs with Azure activity logs using a common timestamp window.

Answer

Create a custom analytics rule in Microsoft Sentinel to alert on repeated logins from the same IP.

Answer

Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel to detect anomalies.

Question 12

A security analyst is hunting for signs of credential dumping using Microsoft Defender for Endpoint. Which advanced hunting query should the analyst use to detect the use of Mimikatz?

Accepted Answer

DeviceProcessEvents where ProcessCommandLine contains 'mimikatz'. DeviceProcessEvents records process creation events, and Mimikatz typically runs as a process. Attackers often execute Mimikatz via command line, so searching the process command line for 'mimikatz' is effective. Option A is wrong because registry events can reveal Mimikatz persistence but not the credential dumping process itself. Option C is wrong because file events may detect the Mimikatz binary but not the execution or dumping. Option D is wrong because network events are irrelevant for local credential dumping.

Answer

DeviceRegistryEvents where RegistryKey contains 'mimikatz'

Answer

DeviceFileEvents where FileName contains 'mimikatz'

Answer

DeviceNetworkEvents where RemoteIP contains 'mimikatz'

Question 13

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. During a hunt, you notice that some alerts from Microsoft Defender for Identity are not appearing in Sentinel. You have verified the connector is enabled and data is flowing for other Defender products. What is the most likely cause?

Accepted Answer

Your tenant does not have the required Microsoft Entra ID P2 license for Microsoft Defender for Identity alerts.. Microsoft Defender for Identity alerts require a premium Azure AD P2 license to be ingested via the connector. Option A is wrong because the connector is enabled. Option B is wrong because data ingestion is working for other products. Option C is wrong because the data types are not disabled.

Answer

The Microsoft Sentinel pricing tier is set to Free, which limits data ingestion.

Answer

The 'IdentityLogonEvents' data type is disabled in the Microsoft Sentinel connector configuration.

Answer

The Microsoft Sentinel workspace is in a different region than Microsoft Defender for Identity.

Question 14

Refer to the exhibit. You are reviewing a KQL query used in a threat hunting campaign. What is the primary purpose of this query?

Accepted Answer

To find users who have signed in more than 5 times from a single IP to an app, and correlate with any user risk events.. The query groups sign-ins by UserPrincipalName, IPAddress, and AppDisplayName, filters to those with more than 5 sign-ins (Count > 5), and then joins with risky user events to correlate with known risky users. Option A is incorrect because the query does not identify top 5 IPs; it filters by a threshold of 5 sign-ins. Option C is incorrect because the query does not calculate average risk score. Option D is incorrect because it does not list all sign-ins from risky IPs; it correlates sign-in patterns with user risk events.

Answer

To identify the top 5 most frequently used IP addresses by each user.

Answer

To calculate the average risk score for users with high sign-in activity.

Answer

To list all sign-ins from IP addresses that have been associated with risk events.

Question 15

You are a threat hunter investigating a potential data exfiltration via Microsoft Teams. You need to identify if any users have shared sensitive files externally. Which hunting approach should you use?

Accepted Answer

Use Microsoft Purview DLP reports to review incidents where sensitive files were shared externally via Teams.. Microsoft Purview Data Loss Prevention (DLP) reports provide detailed information on policy matches, including external sharing of sensitive files via Teams. Option A is wrong because Microsoft Defender for Endpoint device timeline focuses on endpoint device activity, not specifically on Teams file sharing. Option B is wrong because while Microsoft Defender for Cloud Apps can detect anomalous file uploads, it is not the primary hunting approach for identifying externally shared sensitive files via Teams; DLP reports are more direct. Option C is wrong because the Office 365 audit log for file download events does not specifically indicate external sharing of sensitive files; it logs general file access.

Answer

Analyze Microsoft Defender for Endpoint device timeline for file activity related to Teams.

Answer

Run a custom detection rule in Microsoft Defender for Cloud Apps to alert on large file uploads to Teams.

Answer

Query the Office 365 audit log for file download events from Teams.