SC-200 Perform threat hunting Practice Test 8 — 15 Questions

Question 1

You are a security analyst at a company using Microsoft Sentinel. You have been asked to perform a threat hunt to identify potential brute-force attacks against your on-premises Active Directory. The relevant data is ingested into Sentinel from Windows Event Logs (Event ID 4625) and Azure ATP (now Microsoft Defender for Identity). Your hunting query should focus on failed logon attempts with high frequency from the same source IP within a short time window. You need to write a KQL query that returns the top 10 source IPs with the most failed logon attempts in the last 24 hours. Which KQL query should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SecurityEvent | where EventID == 4625 | summarize count() by IpAddress | top 10 by count_. The correct query filters SecurityEvent for EventID 4625 (failed logon), summarizes the count of events grouped by IpAddress, and returns the top 10 by count. In the SecurityEvent table, the source IP field is named IpAddress, and 4625 is the canonical Windows failed-logon event ID. This directly answers the requirement to find the top 10 source IPs with the most failed logons in the last 24 hours.

Answer

SecurityEvent | where EventID == 4625 | summarize count() by SourceIp | top 10 by count_

Answer

SecurityEvent | where EventID == 4624 | summarize count() by IpAddress | top 10 by count_

Answer

SecurityEvent | where EventID in (4624,4625) | summarize count() by IpAddress | top 10 by count_

Question 2

You are a threat hunter for an organization that uses Microsoft Defender XDR. You suspect that an attacker may be using PowerShell to perform reconnaissance on domain controllers. You need to write an advanced hunting query in Microsoft Defender XDR that returns PowerShell commands executed on domain controllers in the last 7 days that contain cmdlets related to Active Directory reconnaissance, such as Get-ADUser or Get-ADGroupMember. The query should also include the device name, account name, and command line. Which query should you use?

Accepted Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where DeviceName contains "DC" | where ProcessCommandLine has_any ("Get-ADUser","Get-ADGroupMember","Get-ADComputer") | project DeviceName, AccountName, ProcessCommandLine. Ly filters by DeviceName containing 'DC' (domain controllers) and ProcessCommandLine containing relevant AD reconnaissance cmdlets, including Get-ADComputer which was added. It also projects the required fields. Option A misses the domain controller filter. Option C does not filter for AD cmdlets. Option D uses the wrong table (DeviceNetworkEvents) and does not filter for AD cmdlets.

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where ProcessCommandLine has_any ("Get-ADUser","Get-ADGroupMember") | project DeviceName, AccountName, ProcessCommandLine

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where DeviceName contains "DC" | project DeviceName, AccountName, ProcessCommandLine

Answer

DeviceNetworkEvents | where Timestamp > ago(7d) | where DeviceName contains "DC" | project DeviceName, AccountName, RemoteIP

Question 3

You are a security analyst using Microsoft Sentinel. During a threat hunt, you need to identify potential data exfiltration via DNS tunneling. You have DNS query logs ingested from your DNS servers via Syslog. The log schema includes fields: TimeGenerated, QueryName, QueryType, ClientIP, ResponseIP. You want to find DNS queries that are unusually long (over 50 characters in the query name) and have a high count of unique responses, which may indicate tunneling. You need to write a KQL query that returns the top 10 client IPs with the most unique response IPs for queries with query name length > 50 in the last 24 hours. Which query should you use?

Accepted Answer

Syslog | where TimeGenerated > ago(24h) | extend QueryNameLength = strlen(QueryName) | where QueryNameLength > 50 | summarize dcount(ResponseIP) by ClientIP | top 10 by dcount_ResponseIP. The correct query filters Syslog events from the last 24 hours, calculates the query name length using strlen(), filters for lengths over 50 characters, then summarizes by counting distinct ResponseIP values per ClientIP using dcount(). The top 10 by dcount_ResponseIP returns the client IPs with the most unique response IPs, which is the exact requirement for identifying potential DNS tunneling.

Answer

Answer

Answer

Syslog | where TimeGenerated > ago(24h) | summarize dcount(ResponseIP) by ClientIP | top 10 by dcount_ResponseIP

Question 4

You are a security operations analyst at a company that uses Microsoft Defender for Cloud Apps (now part of Microsoft Defender XDR) and Microsoft Sentinel. During a threat hunt, you suspect that an attacker may be using a compromised user account to access sensitive data in SharePoint Online from an unusual location. You have Microsoft Defender for Cloud Apps logs integrated into Sentinel. The log schema includes fields: TimeGenerated, UserId, AppName, ActivityType, IPAddress, Location, ObjectId (the document ID). You need to write a KQL query that returns a list of users who accessed the same sensitive document (ObjectId == 'SensitiveDocument123') from more than 3 unique IP addresses in the last hour, which could indicate a distributed access pattern. Which KQL query should you use?

Accepted Answer

CloudAppEvents | where TimeGenerated > ago(1h) | where ObjectId == 'SensitiveDocument123' | summarize dcount(IPAddress) by UserId | where dcount_IPAddress > 3. Ly filters CloudAppEvents for the last hour and the specific sensitive document (ObjectId == 'SensitiveDocument123'), then summarizes the distinct count of IP addresses per user, filtering for users with more than 3 unique IPs. This identifies distributed access by a single user. Option B uses a 24-hour time range instead of 1 hour, which may include legitimate historical access and is not limited to the last hour. Option C does not filter for the specific document, so it returns users who accessed any document from many IPs. Option D uses count() to count the number of log entries per (UserId, IPAddress) and filters for groups with more than 3 entries, which does not count unique IPs per user and may return users with many repeated accesses from the same IP.

Answer

CloudAppEvents | where TimeGenerated > ago(24h) | where ObjectId == 'SensitiveDocument123' | summarize dcount(IPAddress) by UserId | where dcount_IPAddress > 3

Answer

CloudAppEvents | where TimeGenerated > ago(1h) | summarize dcount(IPAddress) by UserId | where dcount_IPAddress > 3

Answer

CloudAppEvents | where TimeGenerated > ago(1h) | where ObjectId == 'SensitiveDocument123' | summarize count() by UserId, IPAddress | where count_ > 3

Question 5

You are conducting a threat hunt in Microsoft Defender XDR for potential ransomware activity. You want to identify devices where a process has encrypted files and then deleted the original files, a common ransomware behavior. Which two KQL queries should you run to detect this activity? (Choose two.)

Accepted Answer

DeviceFileEvents | where ActionType == "FileRenamed" | where FileName endswith ".encrypted" | summarize count() by DeviceId, InitiatingProcessFileName | where count_ > 100. The two correct queries target distinct ransomware behaviors: mass file renaming to an encrypted extension and deletion of shadow copies or backups. Together they provide strong evidence of ransomware preparing to encrypt and preventing recovery. The other queries focus on unrelated activities like SMB connections or registry autoruns, which are not specific to the encryption-then-deletion pattern. Using both queries increases coverage of the attack chain.

Answer

DeviceFileEvents | where ActionType == "FileDeleted" | where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe") | summarize count() by DeviceId | where count_ > 200

Answer

DeviceRegistryEvents | where RegistryKey has "CurrentVersion\Run" | project DeviceId, RegistryValueName, RegistryValueData

Answer

DeviceNetworkEvents | where RemotePort == 445 | summarize count() by DeviceId | where count_ > 50

Question 6

You are a security analyst using Microsoft Sentinel. You want to create a hunting query that identifies all user accounts that have been added to the built-in Administrators group on domain controllers. Which data source and query should you use?

Accepted Answer

SecurityEvent | where EventID == 4732 | where TargetUserName contains "Administrators" | project TimeGenerated, TargetUserName, MemberName. The correct query uses Event ID 4732, which is generated when a member is added to a security-enabled local group. On domain controllers, the Administrators group is a local group, so 4732 captures the addition. The query filters for the group name and projects the member name. Other event IDs correspond to different group scopes or group changes without member details. This query directly answers the hunting requirement.

Answer

SecurityEvent | where EventID == 4735 | where TargetUserName contains "Administrators" | project TimeGenerated, TargetUserName, MemberName

Answer

SecurityEvent | where EventID == 4756 | where TargetUserName contains "Administrators" | project TimeGenerated, TargetUserName, MemberName

Answer

SecurityEvent | where EventID == 4728 | where TargetUserName contains "Administrators" | project TimeGenerated, TargetUserName, MemberName

Question 7

You are a threat hunter in Microsoft Sentinel. You want to identify anomalous sign-in patterns by comparing each user's daily sign-in count to their own 30-day baseline, flagging days where the count exceeds three times the standard deviation. Which KQL operator should you use to calculate the baseline and detect the anomaly?

Accepted Answer

series_decompose_anomalies(). The scenario requires per-user baseline modeling and anomaly flagging based on standard deviation. series_decompose_anomalies() is specifically built for this purpose in KQL, automatically decomposing time series and identifying outliers. Other operators like summarize or make_series only prepare or aggregate data without performing the statistical detection needed to flag days exceeding three standard deviations.

Answer

summarize count() by UserPrincipalName, bin(TimeGenerated, 1d)

Answer

percentile()

Answer

make_series()

Question 8

You are a threat hunter at Contoso. You need to create a custom detection rule in Microsoft Defender XDR that triggers when a suspicious PowerShell script is executed on more than 10 devices within 5 minutes. Which two components are required to define this custom detection rule? (Choose two.)

Accepted Answer

A KQL query that returns the devices and timestamps of the PowerShell execution events.. A custom detection rule in Microsoft Defender XDR requires a KQL query that defines the detection logic and returns the relevant events. Additionally, you must configure the rule settings to specify the alert threshold, such as triggering when the number of affected devices exceeds a certain count within a time window. These two components together enable the rule to function as described.

Answer

A scheduled task in Microsoft Sentinel to run the query every 5 minutes.

Answer

A watchlist in Microsoft Sentinel containing the list of devices to monitor.

Answer

A playbook in Microsoft Sentinel that automatically isolates the affected devices.

Question 9

You are conducting a threat hunt in Microsoft Defender XDR for potential ransomware activity. You want to identify files that have been modified with a suspicious extension (e.g., .locked) and then had their original version deleted, indicating possible encryption and cleanup. Which Advanced Hunting table and operation should you use to correlate file modification and deletion events?

Accepted Answer

DeviceFileEvents | where ActionType in ('FileModified','FileDeleted') | summarize by DeviceId, FileName, FolderPath. DeviceFileEvents is the correct table because it logs file system operations including modifications and deletions. By filtering for both action types and summarizing by device and file path, you can detect when a file is modified (e.g., renamed with .locked) and then deleted, a common ransomware pattern. Other tables lack the necessary file operation data to correlate these events.

Answer

DeviceFileEvents | where ActionType == 'FileCreated' | summarize count() by FileName

Answer

DeviceProcessEvents | where ProcessCommandLine contains '.locked' | project DeviceId, FileName, ProcessCommandLine

Answer

DeviceRegistryEvents | where ActionType == 'RegistryValueSet' | project DeviceId, RegistryKey, RegistryValueName

Question 10

You are threat hunting in Microsoft Defender XDR for potential exfiltration via cloud storage services. You want to identify users who uploaded large amounts of data to personal cloud storage using the browser. Which Advanced Hunting table and field combination should you query?

Accepted Answer

CloudAppEvents | where ActionType == "FileUploaded" and Application has_any ("Dropbox", "Google Drive") and RawEventData.FileSize > 100000000. CloudAppEvents in Microsoft Defender XDR provides visibility into activities within cloud applications, including file uploads. By querying for ActionType 'FileUploaded' and filtering for applications like Dropbox or Google Drive, analysts can detect large data transfers to personal cloud storage. The RawEventData field contains additional details such as file size, enabling precise filtering for potential exfiltration events. This table is populated when Defender for Cloud Apps is integrated.

Answer

DeviceNetworkEvents | where RemoteUrl has_any ("dropbox.com", "drive.google.com") and BytesSent > 100000000

Answer

DeviceFileEvents | where ActionType == "FileUploaded" and FileSize > 100000000 and RemoteUrl contains "dropbox.com"

Answer

EmailEvents | where ActionType == "FileUploaded" and FileSize > 100000000 and RecipientEmailAddress endswith "dropbox.com"

Question 11

You are conducting a threat hunt in Microsoft Sentinel to identify potential persistence mechanisms created by an attacker. You want to query for scheduled tasks and services that were recently created or modified. Which two KQL queries should you use? (Choose two.)

Accepted Answer

SecurityEvent | where EventID == 4698 | project TimeGenerated, Computer, TaskName, TaskContent. Event ID 4698 (scheduled task created) and Event ID 7045 (service installed) are direct indicators of persistence mechanisms. Scheduled tasks and services are common methods attackers use to maintain access. Querying these events in Microsoft Sentinel allows hunters to review newly created tasks and services, inspect their content, and identify malicious entries. Other events like process creation or network connections may provide supporting context but are not as specific for persistence.

Answer

SecurityEvent | where EventID == 4624 | where LogonType == 5

Answer

SecurityEvent | where EventID == 4688 | where NewProcessName contains "schtasks.exe"

Answer

SecurityEvent | where EventID == 5156 | where DestPort == 445

Question 12

You are hunting for potential phishing attacks in Microsoft Defender XDR. You want to find emails that were delivered to user inboxes but later reported by users as phishing. Which Advanced Hunting table and field should you query to identify these emails?

Accepted Answer

EmailPostDeliveryEvents | where ActionType == 'UserReportedPhish'. EmailPostDeliveryEvents is the correct table because it logs post-delivery actions, including user reports. The ActionType field value 'UserReportedPhish' specifically indicates a user reported the email as phishing. Other tables like EmailEvents track system classifications, not user reports, and EmailUrlInfo is for URL data. Thus, EmailPostDeliveryEvents with the appropriate filter is the precise way to find user-reported phishing emails.

Answer

EmailUrlInfo | where Url contains 'phish'

Answer

EmailEvents | where ThreatTypes has 'Phish'

Answer

EmailEvents | where DeliveryAction == 'Delivered' and ThreatTypes has 'Phish'

Question 13

A security analyst is using KQL in Microsoft Sentinel to hunt for potential data exfiltration by a user who has been sending unusually large amounts of data to an external IP address. Which KQL operator should the analyst use to identify the top source IP addresses and total bytes sent over the last 7 days?

Accepted Answer

... | summarize TotalBytes=sum(SentBytes) by SourceIP | top 10 by TotalBytes desc. To identify the top source IPs by total bytes sent over 7 days, the analyst needs to aggregate bytes per source IP and then rank them. `summarize TotalBytes=sum(SentBytes) by SourceIP | top 10 by TotalBytes desc` does exactly that: it sums SentBytes grouped by SourceIP and returns the top 10 by total bytes, which is the correct KQL pattern for this hunt.

Answer

... | where SentBytes > 1000000 | project SourceIP, SentBytes

Answer

... | extend TotalBytes=SentBytes | summarize count() by SourceIP

Answer

... | project SourceIP, SentBytes | sort by SentBytes desc

Question 14

A threat hunter is using Microsoft Defender for Endpoint advanced hunting to investigate a suspicious process that was observed launching from a temporary folder. The hunter wants to find all devices that have executed this specific process (with the same SHA256 hash) in the last 24 hours. Which table and column should be used in the query?

Accepted Answer

DeviceProcessEvents table, SHA256 column. DeviceProcessEvents table tracks process execution events and includes the SHA256 column for the file hash. Therefore, Option C is correct. Option A (DeviceNetworkEvents) is for network connections and does not include SHA256. Option B (DeviceEvents) is a generic table that may not include process hash. Option D (DeviceFileEvents) is for file creation/modification, not execution.

Answer

DeviceNetworkEvents table, SHA256 column

Answer

DeviceEvents table, SHA256 column

Answer

DeviceFileEvents table, SHA256 column

Question 15

A security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to detect when a user account has been used to log in from an unusual location and then immediately performs a password reset for another user. Which hunting approach is most effective for this scenario?

Accepted Answer

Write a KQL query that joins SigninLogs with AuditLogs on user principal name and times within a short window. The most effective hunting approach is a KQL query that correlates SigninLogs (login events, including location) with AuditLogs (password reset operations) by joining on UserPrincipalName and filtering for events within a short time window. This detects the specific behavioral pattern: an unusual-location login immediately followed by a password reset for another user, which is a classic credential theft and privilege abuse indicator.

Answer

Use a Microsoft Sentinel playbook to automatically flag any password reset

Answer

Search the SigninLogs table for logins from unusual locations

Answer

Create a watchlist of known unusual locations and use it in a query against AuditLogs