SC-200 Perform threat hunting Practice Test 8 — 15 Questions

Question 1

During a hunt, you discover that an attacker used a valid but compromised service principal to authenticate to Azure Key Vault and export secrets. Which Microsoft Sentinel hunting query would best identify similar activity across your environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ServicePrincipalSignInLogs | where ResultType == 0 | where ResourceDisplayName contains 'Key Vault'. ServicePrincipalSignInLogs specifically tracks sign-ins by service principals. Filtering for ResultType == 0 (success) and ResourceDisplayName containing 'Key Vault' directly identifies successful authentication attempts to Azure Key Vault by service principals, which matches the attacker's technique. Option A is incorrect because AADManagedIdentitySignInLogs only covers managed identities, not all service principals. Option C is incorrect because SigninLogs primarily captures user sign-ins, not service principal sign-ins. Option D is incorrect because AADUserRiskEvents focuses on user risk events, not service principal activity.

Answer

AADManagedIdentitySignInLogs | where ResultType == 0

Answer

SigninLogs | where ResultType == 0 | where AppDisplayName contains 'Key Vault'

Answer

AADUserRiskEvents | where RiskEventType == 'compromised'

Question 2

You are hunting for signs of ransomware in your environment using Microsoft 365 Defender. Which advanced hunting table should you primarily query to detect file encryption events?

Accepted Answer

DeviceFileEvents. DeviceFileEvents captures file creation, modification, and deletion events, which are typical for ransomware encryption. Option A (DeviceNetworkEvents) is wrong because it captures network connections, not file events. Option B (DeviceProcessEvents) is wrong because it captures process creation and termination, not file events. Option D (DeviceRegistryEvents) is wrong because it captures registry modifications, not file events.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

DeviceRegistryEvents

Question 3

Which TWO of the following are valid techniques for threat hunting using Microsoft Sentinel? (Select TWO.)

Accepted Answer

Using Jupyter notebooks with MSTICpy for advanced analytics.. Options C and D are correct threat hunting techniques in Microsoft Sentinel. C: Using Jupyter notebooks with MSTICpy enables advanced data analysis and visualization for proactive threat hunting. D: The Log Analytics Integrated Viewer (LIVB) provides an interactive interface to visually explore log data, aiding in hunting activities. A: Creating watchlists is a preparatory step for correlation but not a direct hunting technique. B: Deploying playbooks automates remediation, not hunting. E: Automation rules trigger on incident creation for response, not for proactive threat hunting.

Answer

Creating watchlists to correlate data from external sources.

Answer

Deploying playbooks to automatically remediate threats.

Answer

Configuring automation rules to trigger on incident creation.

Question 4

Which THREE of the following are best practices for performing threat hunting in Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Start with a hypothesis based on threat intelligence or recent incidents.. Options C, D, and E are correct. C: Starting with a hypothesis ensures targeted and efficient hunting. D: Combining KQL queries with built-in tools allows flexible and powerful threat detection. E: Hunting across multiple data sources (devices, email, identities) provides comprehensive coverage. A is incorrect because focusing only on automated alerts misses threats that don't trigger rules. B is incorrect because limiting to a single data source reduces visibility and effectiveness.

Answer

Focus only on alerts generated by automated detection rules.

Answer

Limit hunting to a single data source to reduce complexity.

Question 5

Which TWO of the following are valid methods to detect Kerberoasting attacks during a threat hunt? (Select TWO.)

Accepted Answer

Service account logon events with RC4 encryption type.. Options A and B are correct. A: Service account logon events with RC4 encryption type indicate the use of RC4 for TGS requests, a common sign of Kerberoasting. B: Multiple Kerberos TGS requests from a single user account to multiple service accounts suggests an attacker is attempting to crack service account passwords. C: Unusual LDAP queries from a domain controller are not typical for Kerberoasting. D: High volume of NTLM authentication failures is more indicative of password spraying or brute force attacks. E: Detection of forged Kerberos tickets (Golden Ticket) is a different attack involving ticket forgery.

Answer

Unusual number of LDAP queries from a domain controller.

Answer

High volume of NTLM authentication failures from a single IP.

Answer

Detection of forged Kerberos tickets (Golden Ticket) in the domain.

Question 6

You are a threat hunter at Contoso, a multinational company with 10,000 employees. Your production environment includes: Microsoft 365 E5 licenses; Microsoft Sentinel in a central Log Analytics workspace; Microsoft Defender for Endpoint, Office 365, Identity, and Cloud Apps; and Microsoft Entra ID P2. You are tasked with hunting for a potential advanced persistent threat (APT) that may have compromised a high-privilege account. The threat intelligence team has reported that the APT group uses living-off-the-land binaries (LOLBins) to execute malicious code and uses encrypted tunnels to C2 servers. You need to design a hunting query in Microsoft Sentinel that correlates multiple data sources to identify suspicious LOLBin usage combined with unusual network connections. Which approach should you take?

Accepted Answer

Create a KQL query in Microsoft Sentinel that joins DeviceProcessEvents with DeviceNetworkEvents on DeviceId and a 1-minute time window, filtering for LOLBin processes and external IP connections.. It uses a KQL query that joins DeviceProcessEvents and DeviceNetworkEvents on DeviceId and a 1-minute time window, filtering for known LOLBin processes and external IP connections. This correlation enables identification of suspicious LOLBin usage combined with unusual network connections, which aligns with the APT's use of LOLBins and encrypted tunnels. Option B is insufficient because it only looks at network events without considering processes, so it may miss context. Option C is inefficient as it requires manual review of many events without correlation to network connections. Option D is reactive, focusing on alerts rather than proactive hunting.

Answer

Use the 'DeviceNetworkEvents' table alone to find connections to known malicious IPs from the threat intelligence feed.

Answer

Run a query in Advanced hunting that filters DeviceProcessEvents for known LOLBin file names like 'rundll32.exe' and 'mshta.exe', then manually review each instance.

Answer

Set up a custom detection rule in Microsoft Defender for Endpoint to alert on any LOLBin execution, then investigate the alerts.

Question 7

You are a threat hunter at Fabrikam, a mid-sized company with 2,000 users. Your environment uses: Microsoft 365 E3 licenses; Microsoft Sentinel with the Microsoft 365 Defender connector; Microsoft Defender for Office 365; and Microsoft Defender for Endpoint (without Microsoft Defender for Identity). You are investigating a suspicious email campaign where some users received phishing emails with links to a credential harvesting page. You want to proactively search for any users who may have entered credentials on the phishing page. You have no direct logs from the phishing server. Which hunting approach should you use in Microsoft Sentinel?

Accepted Answer

Query the UrlClickEvents table to identify users who clicked the malicious link, then correlate with AADSignInEventsBeta to find sign-ins from new IPs after the click.. The UrlClickEvents table records clicks on Safe Links from phishing emails, and correlating with AADSignInEventsBeta can identify users who clicked and later signed in from new IPs, indicating potential credential theft. Option B is incorrect because DeviceProcessEvents may not capture web form submissions. Option C is incorrect because sign-in anomalies alone might not be directly linked to the phishing campaign. Option D is incorrect because email events only show receipt, not click or credential entry.

Answer

Query the DeviceProcessEvents table for any browser process that accessed the phishing URL.

Answer

Query the AADSignInEventsBeta table for users who signed in shortly after the email campaign from IPs not previously seen.

Answer

Query the EmailEvents table for users who received the phishing email and then check if they have any subsequent sign-in anomalies.

Question 8

You are a security analyst at Wingtip Toys, a small business with 500 users. You have Microsoft 365 Business Premium licenses and Microsoft Sentinel deployed. You are conducting a threat hunt for signs of brute-force attacks against your Azure AD tenant. You want to identify IP addresses that have attempted multiple failed sign-ins across different user accounts within a short time window. You have access to the SigninLogs table in Microsoft Sentinel. Which KQL query should you use?

Accepted Answer

SigninLogs | where ResultType !in ('0', '50125') | summarize FailedAttempts = count(), DistinctUsers = dcount(UserPrincipalName) by IPAddress | where FailedAttempts > 10 and DistinctUsers > 5 | order by FailedAttempts desc. It filters for failed sign-ins (ResultType != 0 and excluding specific error codes that are not failures), then groups by IPAddress to count total failed attempts and distinct user accounts. The where clause then selects IPs with more than 10 failed attempts and more than 5 distinct users, which is a strong indicator of a brute-force attack across multiple accounts. Options A, C, and D are incorrect: A counts all failures by IP but does not require multiple users; C only returns the top 10 IPs without aggregation; D counts successful sign-ins, not failures.

Answer

SigninLogs | where ResultType != 0 | summarize FailedAttempts = count() by IPAddress | where FailedAttempts > 10

Answer

SigninLogs | where ResultType != 0 | top 10 by IPAddress

Answer

SigninLogs | where ResultType == 0 | summarize SuccessAttempts = count() by IPAddress | order by SuccessAttempts desc

Question 9

You are investigating a series of failed logon attempts across multiple on-premises servers. You want to use Microsoft Sentinel to hunt for patterns of brute-force attacks. Which data source should you ingest to capture detailed authentication events from domain controllers?

Accepted Answer

Windows Security Events via Windows Event Forwarding. Windows Security Events from domain controllers, collected via Windows Event Forwarding (WEF) or directly, include Event ID 4625 (failed logon) and other authentication events necessary for brute-force hunting. Option A is incorrect because Syslog from domain controllers does not capture Windows Security Events; Syslog is typically used for network devices or Linux systems. Option C is incorrect because Azure Activity Log records Azure resource management operations, not on-premises authentication events. Option D is incorrect because Microsoft 365 Defender events cover cloud and endpoint alerts but not detailed authentication logs from on-premises domain controllers.

Answer

Syslog from domain controllers

Answer

Azure Activity Log

Answer

Microsoft 365 Defender events

Question 10

During a threat hunt, you notice an unusual number of DNS queries for randomly generated subdomains from a single workstation. You suspect data exfiltration via DNS tunneling. Which KQL query in Microsoft Sentinel would best help you identify the suspicious domain names?

Accepted Answer

let entropy_threshold = 4.0; let length_threshold = 20; CommonSecurityLog | where DeviceVendor == "Palo Alto" | extend entropy = strlen(DestinationHostName) - countof(DestinationHostName, 'a', 'z') / strlen(DestinationHostName) | where entropy > entropy_threshold or strlen(DestinationHostName) > length_threshold. It calculates entropy and length to detect algorithmically generated domains (DGA), a common indicator of DNS tunneling. Option B is incorrect because filtering out non-.com domains may miss many DGA domains. Option C is incorrect because it relies on a static threat intelligence list rather than dynamic analysis. Option D is incorrect because it only lists top domains by count without assessing randomness.

Answer

CommonSecurityLog | where DestinationHostName !endswith ".com"

Answer

CommonSecurityLog | where DestinationHostName in (dynamic_threat_intel_list)

Answer

CommonSecurityLog | where DeviceVendor == "Palo Alto" | summarize count() by DestinationHostName | top 10 by count_

Question 11

Refer to the exhibit. You are reviewing a custom hunting query in Microsoft Defender XDR. The query aims to identify devices with more than 100 outbound connections in the last 30 days to IPs that appear in active threat intelligence indicators. However, the query returns no results. What is the most likely cause?

Accepted Answer

The ThreatIntelligenceIndicator table does not contain any indicators with an Active status that match the remote IPs.. The most likely cause is that the ThreatIntelligenceIndicator table does not contain any active indicators that match the remote IPs from the DeviceNetworkEvents. The query uses an inner join between DeviceNetworkEvents and ThreatIntelligenceIndicator on RemoteIP and NetworkIP. If there are no matching indicators, the join produces zero results. Option A is incorrect because filtering for public IPs is correct for outbound connections to the internet. Option B is incorrect because IP version mismatch would cause a join failure, but the query would still return results if the version matched. Option D is incorrect because the threshold of 100 connections may be high, but if there were matching indicators, some devices would return results.

Answer

The RemoteIPType filter for 'Public' excludes all internal IPs, but devices connect to internal IPs mostly.

Answer

The join on RemoteIP and NetworkIP is mismatched because one is IPv4 and the other IPv6.

Answer

The ConnectionCount threshold of 100 is too high; most devices do not exceed this.

Question 12

You are conducting a threat hunt for possible credential dumping using Mimikatz. Which Windows Security Event ID should you focus on in Microsoft Sentinel to detect potential use of Mimikatz?

Accepted Answer

Event ID 10 (Process accessed). Event ID 10 (Lsass process access) is a common indicator of Mimikatz usage. Option B is wrong because Event ID 4688 is process creation, too broad. Option C is wrong because Event ID 4625 is failed logon, unrelated. Option D is wrong because Event ID 5156 is for Windows Filtering Platform connections, not credential dumping.

Answer

Event ID 4688 (Process creation)

Answer

Event ID 4625 (Failed logon)

Answer

Event ID 5156 (WFP connection)

Question 13

Your organization uses Microsoft Sentinel with custom analytics rules. During a threat hunt, you want to identify lateral movement using pass-the-hash techniques. Which data source combination is most effective?

Accepted Answer

Windows Security Event ID 4624 (Logon) with LogonType 3 and NTLM attributes. Windows Security Event ID 4624 with LogonType 3 (network logon) and NTLM authentication attributes are key indicators of pass-the-hash attacks, as NTLM is the protocol typically exploited. Option A is wrong because Azure AD sign-in logs only cover cloud authentication, not on-premises lateral movement. Option B is wrong because DeviceEvents and DeviceLogonEvents from Microsoft Defender for Endpoint focus on endpoint behavior and do not provide the detailed NTLM attributes needed. Option C is wrong because Sysmon Event ID 3 and Windows Firewall logs capture network connections, not authentication details.

Answer

Azure AD sign-in logs and Office 365 audit logs

Answer

DeviceEvents and DeviceLogonEvents from Microsoft Defender for Endpoint

Answer

Sysmon Event ID 3 (Network connect) and Windows Firewall logs

Question 14

While hunting in Microsoft Sentinel, you find a KQL query that uses the `evaluate` operator with `bag_unpack` to expand JSON properties. The query runs slowly and times out. What is the best practice to optimize this query?

Accepted Answer

Add a `where` clause to filter rows before applying `bag_unpack`.. Adding a `where` clause before the `evaluate` operator with `bag_unpack` reduces the number of rows processed, thereby improving performance. Option A is incorrect because increasing concurrency and nodes may not solve the problem if the query is not efficiently structured. Option B is incorrect because simply removing `evaluate` and using `extend` with `parse_json` may not achieve the same functionality and could still be slow. Option D is incorrect because `materialize` caches the entire table, which can be inefficient if the dataset is large, and does not address the root cause of unnecessary row processing.

Answer

Increase the cluster's concurrency and nodes.

Answer

Remove the `evaluate` operator and use `extend` with `parse_json`.

Answer

Use the `materialize` function to cache the entire table before expansion.

Question 15

You are hunting for signs of ransomware using Microsoft Defender XDR's advanced hunting. Which query pattern would best identify a process that encrypts many files in a short time?

Accepted Answer

DeviceFileEvents | where ActionType == 'FileModified' | summarize Count = count() by DeviceName, InitiatingProcessFileName, bin(Timestamp, 5m) | where Count > 100. It counts the number of file modifications per initiating process per 5-minute window using DeviceFileEvents, and then filters for those with more than 100 modifications. This directly detects a process that is rapidly encrypting many files, which is a strong indicator of ransomware. Option A is wrong because it measures the duration between the first and last file event by a process, not the count; a process could encrypt files over a longer period and still be suspicious, but this query would miss high-density encryption in a short burst. Option C is wrong because it only looks at process creation events for specific script interpreters (powershell.exe, wscript.exe), not at file modifications, and it fails to identify encryption activity from other executables. Option D is wrong because it counts all file events per device without grouping by process, so it cannot pinpoint which process is responsible for the encryption.

Answer

DeviceFileEvents | summarize Duration = max(Timestamp)-min(Timestamp) by DeviceName, InitiatingProcessFileName | where Duration < 1h

Answer

DeviceProcessEvents | where FileName in ('powershell.exe', 'wscript.exe') | summarize by DeviceName

Answer

DeviceFileEvents | summarize Count = count() by DeviceName | where Count > 1000