SC-200 Perform threat hunting Practice Test 8 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing a KQL query used in a threat hunting campaign. What is the primary purpose of this query?

Accepted Answer

To find users who have signed in more than 5 times from a single IP to an app, and correlate with any user risk events.. Option A is correct because the query identifies users with high sign-in counts from specific IPs and apps, and joins with risk events to correlate with known risky users. Option B is wrong because it doesn't filter only risky users. Option C is wrong because it aggregates by user, not unique IPs. Option D is wrong because it compares signin count to a threshold, not risk score.

Answer

To identify the top 5 most frequently used IP addresses by each user.

Answer

To calculate the average risk score for users with high sign-in activity.

Answer

To list all sign-ins from IP addresses that have been associated with risk events.

Question 2

You are a threat hunter investigating a potential data exfiltration via Microsoft Teams. You need to identify if any users have shared sensitive files externally. Which hunting approach should you use?

Accepted Answer

Use Microsoft Purview DLP reports to review incidents where sensitive files were shared externally via Teams.. Option B is correct because Microsoft Purview Data Loss Prevention (DLP) provides detailed reports on policy matches, including external sharing. Option A is wrong because audit logs alone are too raw. Option C is wrong because it focuses on malware. Option D is wrong because it's about endpoint devices.

Answer

Analyze Microsoft Defender for Endpoint device timeline for file activity related to Teams.

Answer

Run a custom detection rule in Microsoft Defender for Cloud Apps to alert on large file uploads to Teams.

Answer

Query the Office 365 audit log for file download events from Teams.

Question 3

During a hunt, you discover that an attacker used a valid but compromised service principal to authenticate to Azure Key Vault and export secrets. Which Microsoft Sentinel hunting query would best identify similar activity across your environment?

Accepted Answer

ServicePrincipalSignInLogs | where ResultType == 0 | where ResourceDisplayName contains 'Key Vault'. Option C is correct because ServicePrincipalSignInLogs track service principal sign-ins, and auditing for successful access to Key Vault can reveal similar compromises. Option A is wrong because it's about user sign-ins. Option B is wrong because it's for user risk. Option D is wrong because it's for managed identity, not all service principals.

Answer

AADManagedIdentitySignInLogs | where ResultType == 0

Answer

SigninLogs | where ResultType == 0 | where AppDisplayName contains 'Key Vault'

Answer

AADUserRiskEvents | where RiskEventType == 'compromised'

Question 4

You are hunting for signs of ransomware in your environment using Microsoft 365 Defender. Which advanced hunting table should you primarily query to detect file encryption events?

Accepted Answer

DeviceFileEvents. Option B is correct because DeviceFileEvents captures file creation, modification, and deletion events, which are typical for ransomware encryption. Option A is wrong because it's for network connections. Option C is wrong because it's for process creation. Option D is wrong because it's for registry modifications.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

DeviceRegistryEvents

Question 5

As a threat hunter, you want to proactively search for signs of privilege escalation using the 'AzureHound' tool within your Microsoft Sentinel environment. Which data source is most relevant to ingest to detect AzureHound usage?

Accepted Answer

Azure Active Directory Audit Logs (now Microsoft Entra ID Audit Logs). Option D is correct because AzureHound uses the Microsoft Graph API to collect Azure AD data, and that activity is logged in AuditLogs. Option A is wrong because AzureHound does not run on VMs. Option B is wrong because it's not about networking. Option C is wrong because AzureHound does not create storage blobs.

Answer

Azure VM Insights logs

Answer

Azure Storage analytics logs

Answer

Azure Network Watcher logs

Question 6

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You are hunting for a threat that uses 'process hollowing' to evade detection. Which advanced hunting query in Microsoft Defender for Endpoint would be most effective?

Accepted Answer

DeviceProcessEvents | where InitiatingProcessFileName != ImageFileName | where ParentProcessFileName != ImageFileName. Option A is correct because process hollowing often involves a child process with a different parent image; DeviceProcessEvents can show such anomalies. Option B is wrong because it looks for specific image names. Option C is wrong because file events are less direct. Option D is wrong because it waits for alerts.

Answer

DeviceProcessEvents | where FileName in~ ('rundll32.exe', 'regsvr32.exe', 'mshta.exe')

Answer

DeviceFileEvents | where FileName contains 'hollow'

Answer

AlertInfo | where Title contains 'Process hollowing'

Question 7

Which TWO of the following are valid techniques for threat hunting using Microsoft Sentinel? (Select TWO.)

Accepted Answer

Using Jupyter notebooks with MSTICpy for advanced analytics.. Options A and B are correct. A: Jupyter notebooks allow custom analysis. B: LIVB provides interactive investigation. C: Automation rules are for response, not hunting. D: Watchlists can be used but are not a hunting technique per se. E: Playbooks are for automated response.

Answer

Creating watchlists to correlate data from external sources.

Answer

Deploying playbooks to automatically remediate threats.

Answer

Configuring automation rules to trigger on incident creation.

Question 8

Which THREE of the following are best practices for performing threat hunting in Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Start with a hypothesis based on threat intelligence or recent incidents.. Options A, B, and D are correct. A: Documenting hypotheses is key. B: Using multiple data sources enriches hunting. D: Hunting across endpoints, email, and identities provides full coverage. C: Relying solely on alerts is reactive. E: Using sample data may miss threats in other segments.

Answer

Focus only on alerts generated by automated detection rules.

Answer

Limit hunting to a single data source to reduce complexity.

Question 9

Which TWO of the following are valid methods to detect Kerberoasting attacks during a threat hunt? (Select TWO.)

Accepted Answer

Service account logon events with RC4 encryption type.. Options B and D are correct. B: Unusual TGS requests from a single user can indicate Kerberoasting. D: Service account usage with RC4 encryption is a sign of Kerberoasting. A: NTLM authentication is not specific. C: Golden ticket attacks involve different artifacts.

Answer

Unusual number of LDAP queries from a domain controller.

Answer

High volume of NTLM authentication failures from a single IP.

Answer

Detection of forged Kerberos tickets (Golden Ticket) in the domain.

Question 10

You are a threat hunter at Contoso, a multinational company with 10,000 employees. Your production environment includes: Microsoft 365 E5 licenses; Microsoft Sentinel in a central Log Analytics workspace; Microsoft Defender for Endpoint, Office 365, Identity, and Cloud Apps; and Microsoft Entra ID P2. You are tasked with hunting for a potential advanced persistent threat (APT) that may have compromised a high-privilege account. The threat intelligence team has reported that the APT group uses living-off-the-land binaries (LOLBins) to execute malicious code and uses encrypted tunnels to C2 servers. You need to design a hunting query in Microsoft Sentinel that correlates multiple data sources to identify suspicious LOLBin usage combined with unusual network connections. Which approach should you take?

Accepted Answer

Create a KQL query in Microsoft Sentinel that joins DeviceProcessEvents with DeviceNetworkEvents on DeviceId and a 1-minute time window, filtering for LOLBin processes and external IP connections.. Option B is correct because the KQL query joins DeviceProcessEvents and DeviceNetworkEvents on DeviceId and timestamp to find processes with suspicious command lines and subsequent network connections to external IPs. Option A is wrong because it does not correlate processes with network connections. Option C is wrong because it uses only network data without process context. Option D is wrong because it focuses only on alerts, missing proactive hunting.

Answer

Use the 'DeviceNetworkEvents' table alone to find connections to known malicious IPs from the threat intelligence feed.

Answer

Run a query in Advanced hunting that filters DeviceProcessEvents for known LOLBin file names like 'rundll32.exe' and 'mshta.exe', then manually review each instance.

Answer

Set up a custom detection rule in Microsoft Defender for Endpoint to alert on any LOLBin execution, then investigate the alerts.

Question 11

You are a threat hunter at Fabrikam, a mid-sized company with 2,000 users. Your environment uses: Microsoft 365 E3 licenses; Microsoft Sentinel with the Microsoft 365 Defender connector; Microsoft Defender for Office 365; and Microsoft Defender for Endpoint (without Microsoft Defender for Identity). You are investigating a suspicious email campaign where some users received phishing emails with links to a credential harvesting page. You want to proactively search for any users who may have entered credentials on the phishing page. You have no direct logs from the phishing server. Which hunting approach should you use in Microsoft Sentinel?

Accepted Answer

Query the UrlClickEvents table to identify users who clicked the malicious link, then correlate with AADSignInEventsBeta to find sign-ins from new IPs after the click.. Option C is correct because using URL click verdict data from Defender for Office 365's Safe Links can show which users clicked the malicious link, and correlating with subsequent sign-ins from unusual IPs can indicate credential compromise. Option A is wrong because email events show delivery but not credential entry. Option B is wrong because sign-in logs alone may not be linked to the phishing. Option D is wrong because endpoint process events are less likely to capture web form submissions.

Answer

Query the DeviceProcessEvents table for any browser process that accessed the phishing URL.

Answer

Query the AADSignInEventsBeta table for users who signed in shortly after the email campaign from IPs not previously seen.

Answer

Query the EmailEvents table for users who received the phishing email and then check if they have any subsequent sign-in anomalies.

Question 12

You are a security analyst at Wingtip Toys, a small business with 500 users. You have Microsoft 365 Business Premium licenses and Microsoft Sentinel deployed. You are conducting a threat hunt for signs of brute-force attacks against your Azure AD tenant. You want to identify IP addresses that have attempted multiple failed sign-ins across different user accounts within a short time window. You have access to the SigninLogs table in Microsoft Sentinel. Which KQL query should you use?

Accepted Answer

SigninLogs | where ResultType !in ('0', '50125') | summarize FailedAttempts = count(), DistinctUsers = dcount(UserPrincipalName) by IPAddress | where FailedAttempts > 10 and DistinctUsers > 5 | order by FailedAttempts desc. Option A is correct because it summarizes failed sign-ins by IP and counts distinct users, filtering for IPs with many attempts across many users. Option B is wrong because it counts total attempts without requiring multiple users. Option C is wrong because it only returns the top IP. Option D is wrong because it counts success, not failures.

Answer

SigninLogs | where ResultType != 0 | summarize FailedAttempts = count() by IPAddress | where FailedAttempts > 10

Answer

SigninLogs | where ResultType != 0 | top 10 by IPAddress

Answer

SigninLogs | where ResultType == 0 | summarize SuccessAttempts = count() by IPAddress | order by SuccessAttempts desc

Question 13

You are investigating a series of failed logon attempts across multiple on-premises servers. You want to use Microsoft Sentinel to hunt for patterns of brute-force attacks. Which data source should you ingest to capture detailed authentication events from domain controllers?

Accepted Answer

Windows Security Events via Windows Event Forwarding. Option C is correct because Windows Security Events from domain controllers include Event ID 4625 (failed logon) necessary for brute-force hunting. Option A is wrong because Azure Activity Log does not include on-premises authentication. Option B is wrong because Microsoft 365 Defender events focus on cloud identities. Option D is wrong because Syslog typically contains network device logs, not Windows authentication.

Answer

Syslog from domain controllers

Answer

Azure Activity Log

Answer

Microsoft 365 Defender events

Question 14

During a threat hunt, you notice an unusual number of DNS queries for randomly generated subdomains from a single workstation. You suspect data exfiltration via DNS tunneling. Which KQL query in Microsoft Sentinel would best help you identify the suspicious domain names?

Accepted Answer

let entropy_threshold = 4.0; let length_threshold = 20; CommonSecurityLog | where DeviceVendor == "Palo Alto" | extend entropy = strlen(DestinationHostName) - countof(DestinationHostName, 'a', 'z') / strlen(DestinationHostName) | where entropy > entropy_threshold or strlen(DestinationHostName) > length_threshold. Option B is correct because it calculates entropy and length to detect algorithmically generated domains, a common indicator of DNS tunneling. Option A is wrong because it only lists top domains by count, not randomness. Option C is wrong because it filters non-.com domains, missing many DGA domains. Option D is wrong because it queries a static threat intelligence list, not dynamic analysis.

Answer

CommonSecurityLog | where DestinationHostName !endswith ".com"

Answer

CommonSecurityLog | where DestinationHostName in (dynamic_threat_intel_list)

Answer

CommonSecurityLog | where DeviceVendor == "Palo Alto" | summarize count() by DestinationHostName | top 10 by count_

Question 15

Refer to the exhibit. You are reviewing a custom hunting query in Microsoft Defender XDR. The query aims to identify devices with more than 100 outbound connections in the last 30 days to IPs that appear in active threat intelligence indicators. However, the query returns no results. What is the most likely cause?

Accepted Answer

The ThreatIntelligenceIndicator table does not contain any indicators with an Active status that match the remote IPs.. Option D is correct because the join uses inner join; if the ThreatIntelligenceIndicator table does not have any active indicators matching the remote IPs, no results are returned. Option A is wrong because the connection count threshold is reasonable. Option B is wrong because the join key is correct. Option C is wrong because the RemoteIPType filter is correct for public IPs.

Answer

The RemoteIPType filter for 'Public' excludes all internal IPs, but devices connect to internal IPs mostly.

Answer

The join on RemoteIP and NetworkIP is mismatched because one is IPv4 and the other IPv6.

Answer

The ConnectionCount threshold of 100 is too high; most devices do not exceed this.

SC-200 Perform threat hunting Practice Test 8 — 15 Questions

Exhibit

SC-200 Perform threat hunting Practice Test 8 — 15 Questions

Exhibit