SC-200 Perform threat hunting Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. During a threat hunt, you find that a user accessed a sensitive SharePoint site from an anonymous IP address. Which hunting method would best identify all users who accessed the same site from similar anonymous IPs?

Accepted Answer

Query CloudAppEvents in Advanced hunting for the SharePoint site URL and filter by IP category 'AnonymousProxy'. Using KQL to query CloudAppEvents for the specific SharePoint site and filtering by IP address categories (e.g., AnonymousProxy) is the most direct method. Option A (Azure AD sign-in logs) may not include SharePoint site-level access. Option B (Microsoft Defender for Endpoint) is for endpoint activities. Option D (Microsoft Purview) focuses on data classification and governance.

Answer

Query DeviceEvents for network connections from the anonymous IP

Answer

Use Microsoft Purview to scan for sensitive data accessed from anonymous IPs

Answer

Search Azure AD sign-in logs for the same IP

Question 2

You are threat hunting in Microsoft Sentinel and have enabled UEBA. You want to detect a possible privilege escalation where a user creates a new user account and adds it to a privileged role within minutes. Which UEBA anomaly type should you investigate?

Accepted Answer

Mass role assignment changes. UEBA detects 'Mass role assignment changes' as an anomaly that could indicate privilege escalation. Option A (Impossible travel) is for geographic anomalies. Option B (Unusual file access) is for data exfiltration. Option D (Anomalous sign-in) focuses on authentication.

Answer

Unusual file access

Answer

Impossible travel

Answer

Anomalous sign-in

Question 3

A threat hunter is using Microsoft Defender XDR Advanced hunting to find evidence of credential dumping. Which table should be queried to detect use of tools like Mimikatz?

Accepted Answer

DeviceEvents. DeviceEvents table includes events from security sensors, including detection of credential dumping tools like Mimikatz. Option B (IdentityLogonEvents) is for logon events. Option C (EmailEvents) for email. Option D (CloudAppEvents) for cloud apps.

Answer

CloudAppEvents

Answer

IdentityLogonEvents

Answer

EmailEvents

Question 4

During a threat hunt, you find an alert for a suspicious PowerShell script that encoded a payload. You want to decode the script to understand its intent. Which Microsoft Sentinel feature can assist with this task?

Accepted Answer

Hunting blade with KQL using base64_decode_tostring(). Sentinel's Entity behavior analytics can provide context, but for decoding, using a custom notebook or Azure Functions with PowerShell is more direct. However, the question asks for a feature; the correct answer is to use the 'Hunting' blade with a custom KQL query that uses base64_decode_tostring() function. Option A (Playbooks) are for automated response. Option B (Workbooks) for visualization. Option D (Analytics rules) for detection.

Answer

Playbooks

Answer

Workbooks

Answer

Analytics rules

Question 5

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You are hunting for signs of a possible Kerberos Golden Ticket attack. Which advanced hunting table should you query to detect anomalous Kerberos ticket-granting ticket (TGT) requests?

Accepted Answer

IdentityDirectoryEvents. IdentityDirectoryEvents captures domain controller events, including Kerberos authentication details. Option A (IdentityLogonEvents) is for user logons. Option B (DeviceEvents) for endpoint processes. Option D (CloudAppEvents) for cloud apps.

Answer

IdentityLogonEvents

Answer

DeviceEvents

Answer

CloudAppEvents

Question 6

While threat hunting in Microsoft Defender for Cloud Apps, you notice a user has an unusually high number of failed login attempts from a single IP address. What is the most effective next step to determine if this is a brute-force attack?

Accepted Answer

Investigate the IP address in the Microsoft Defender for Cloud Apps Activity log to review all failed attempts. Using the Activity log to filter by the IP and reviewing failures is the most direct method. Option B (Blocking the IP) is premature. Option C (Creating an anomaly detection policy) is for future detection. Option D (Investigating the user's device) is not relevant for cloud app access.

Answer

Immediately block the IP address

Answer

Create a new anomaly detection policy for that user

Answer

Check the user's device for malware

Question 7

The KQL query above is used in a threat hunt. What is the most likely scenario this query is designed to detect?

Accepted Answer

Hunting for code execution via rundll32.exe loading JavaScript. The query looks for PowerShell spawning rundll32.exe with a command line containing 'javascript:', which is a common technique to execute JavaScript via rundll32 as a form of code execution or bypass. Option A is incorrect because regsvr32.exe is not involved. Option B is for lateral movement, not shown. Option D is for data exfiltration, not indicated.

Answer

Identification of lateral movement using PsExec

Answer

Discovery of data exfiltration using FTP

Answer

Detection of regsvr32.exe being used to execute scriptlet files

Question 8

The exhibit shows a hunting query definition in Microsoft Sentinel. What is the primary issue with this hunting query?

Accepted Answer

The ipv4_lookup function is used incorrectly because it requires a data source parameter. The query uses ipv4_lookup with a static lookup table 'solorigate_ips', but this function expects a parameter for the lookup data source. The correct syntax should reference a table or inline list. Option A is incorrect because the function exists. Option C is incorrect because the query scans the entire DeviceEvents table. Option D is incorrect because there is no syntax error with ActionType.

Answer

The ActionType filter is invalid

Answer

The query does not filter by timestamp

Answer

The ipv4_lookup function does not exist in KQL

Question 9

A threat hunter runs the KQL query above in Microsoft Sentinel. What is the main limitation of this query?

Accepted Answer

The query relies on an external data source that may be slow or unavailable. Using externaldata() to fetch a list from a public URL may introduce latency or fail if the URL is unreachable, and the list may not be updated in real-time. Option A is incorrect because IdentityLogonEvents does contain IPAddress. Option B is incorrect because the query correctly references the let statement. Option D is incorrect because externaldata supports CSV format.

Answer

The IdentityLogonEvents table does not have an IPAddress column

Answer

The let statement is incorrectly defined because it uses externaldata without a schema

Answer

The with(format="csv") is invalid

Question 10

Which TWO actions are effective when threat hunting for lateral movement using remote desktop protocol (RDP) in Microsoft Defender XDR?

Accepted Answer

Query DeviceNetworkEvents for inbound connections on port 3389. Querying DeviceNetworkEvents for inbound RDP connections (port 3389) helps identify potential lateral movement. Correlating with LogonEvents for successful RDP logins confirms the movement. Option B (looking for SMB connections) is more for file sharing. Option D (checking email forwarding) is for exfiltration. Option E (reviewing cloud app activities) is not directly RDP-related.

Answer

Review CloudAppEvents for access to cloud apps from multiple IPs

Answer

Check for unusual email forwarding rules

Answer

Search for SMB file share connections

Question 11

Which THREE data sources should be included in a threat hunt to detect data exfiltration via DNS tunneling in Microsoft Sentinel?

Accepted Answer

Network flow logs (e.g., Azure Network Watcher). DNS events (from DNS servers or Azure DNS), network flow logs (to see volume), and Windows Event Logs (if DNS server logs are not directly available) can help detect DNS tunneling. Option C (Azure Key Vault logs) are for secret access. Option E (Microsoft 365 audit logs) are for user activities.

Answer

Azure Key Vault diagnostic logs

Answer

Microsoft 365 audit logs

Question 12

Which THREE actions are recommended when conducting a threat hunt for compromised identities using Microsoft Sentinel UEBA?

Accepted Answer

Search for access to applications the user does not normally use. UEBA is used to detect anomalous behavior; focusing on unusual logon times, multiple failed attempts, and unusual application access are key indicators of compromised identities. Option C (investigating firewall changes) is more for network security. Option E (reviewing DNS logs) is for network anomalies.

Answer

Query DNS logs for unusual domain resolutions

Answer

Investigate changes to firewall rules

Question 13

During a threat hunt in Microsoft Sentinel, you identify a series of successful logins from an unusual IP address to multiple Azure VM instances. The logins occur outside business hours. Which hunting technique would be most effective to correlate these events with potential lateral movement?

Accepted Answer

Use Microsoft Defender for Cloud Apps to perform session replay of the user's activities during that time.. Option B is correct because session replay allows you to reconstruct the sequence of events and identify lateral movement patterns. Option A is wrong because timeline correlation might miss the specific sequence. Option C is wrong because anomaly detection alone doesn't link the events. Option D is wrong because it's a detection, not hunting.

Answer

Run a KQL query that correlates sign-in logs with Azure activity logs using a common timestamp window.

Answer

Create a custom analytics rule in Microsoft Sentinel to alert on repeated logins from the same IP.

Answer

Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel to detect anomalies.

Question 14

A security analyst is hunting for signs of credential dumping using Microsoft Defender for Endpoint. Which advanced hunting query should the analyst use to detect the use of Mimikatz?

Accepted Answer

DeviceProcessEvents where ProcessCommandLine contains 'mimikatz'. Option C is correct because DeviceProcessEvents records process creation events, and Mimikatz often appears as a process. Option A is wrong because network events are not directly related to local credential dumping. Option B is wrong because registry events may show persistence but not the dumping itself. Option D is wrong because file creation events are less direct for process-based tools.

Answer

DeviceRegistryEvents where RegistryKey contains 'mimikatz'

Answer

DeviceFileEvents where FileName contains 'mimikatz'

Answer

DeviceNetworkEvents where RemoteIP contains 'mimikatz'

Question 15

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. During a hunt, you notice that some alerts from Microsoft Defender for Identity are not appearing in Sentinel. You have verified the connector is enabled and data is flowing for other Defender products. What is the most likely cause?

Accepted Answer

Your tenant does not have the required Microsoft Entra ID P2 license for Microsoft Defender for Identity alerts.. Option D is correct because Microsoft Defender for Identity alerts require a premium Azure AD P2 license to be ingested via the connector. Option A is wrong because the connector is enabled. Option B is wrong because data ingestion is working for other products. Option C is wrong because the data types are not disabled.

Answer

The Microsoft Sentinel pricing tier is set to Free, which limits data ingestion.

Answer

The 'IdentityLogonEvents' data type is disabled in the Microsoft Sentinel connector configuration.

Answer

The Microsoft Sentinel workspace is in a different region than Microsoft Defender for Identity.