SC-200 Perform threat hunting Practice Test 9 — 15 Questions

Question 1

Which TWO data sources are most useful for detecting unauthorized lateral movement in a hybrid environment using Microsoft Sentinel?

Accepted Answer

Microsoft Defender for Endpoint DeviceLogonEvents. Options C and D are correct. Microsoft Defender for Endpoint DeviceLogonEvents (C) provides detailed endpoint logon telemetry, and Windows Security Events Event ID 4624 (D) records successful logon attempts. Both are key data sources for detecting lateral movement. Option A (Azure Activity Log) records control plane operations, not logons. Option B (Network Security Group Flow Logs) shows network traffic but lacks authentication context. Option E (Office 365 Audit Logs) focuses on cloud app activity, not on-premises or hybrid logons.

Answer

Azure Activity Log

Answer

Network Security Group Flow Logs

Answer

Office 365 Audit Logs

Question 2

Which THREE techniques are effective for hunting for living-off-the-land (LotL) attacks using Microsoft Sentinel?

Accepted Answer

Hunting for WMI activity using Event ID 5861 and correlating with process creation events.. Living-off-the-land (LotL) attacks use native system tools to avoid detection. The correct techniques are: B - WMI activity (Event ID 5861) indicates lateral movement when correlated with process creation; D - PowerShell script block logs (Event ID 4104) reveal encoded or obfuscated commands; E - remote service creation (Event ID 7045) paired with admin tool network connections points to PsExec-like abuse. Option A is incorrect because installing third-party software is not a LotL technique; LotL relies on built-in tools. Option C is incorrect because non-interactive logon sessions (Logon Type 5) are typical for services and not specific to LotL attacks.

Answer

Monitoring for installation of third-party software on endpoints.

Answer

Tracking non-interactive logon sessions (Logon Type 5).

Question 3

Which TWO are common indicators of compromise (IOCs) used in threat hunting with Microsoft Sentinel?

Accepted Answer

File hashes (MD5, SHA256). File hashes (MD5, SHA256) and IP addresses are standard indicators of compromise (IOCs) used in threat hunting with Microsoft Sentinel. Usernames and device names are artifacts, not IOCs. Registry keys can be IOCs but are less commonly used as primary indicators.

Answer

Usernames

Answer

Device names

Answer

Registry keys

Question 4

You are hunting for possible data exfiltration via email in Microsoft 365. Which data source in Microsoft Sentinel provides the most relevant telemetry for email forwarding rules?

Accepted Answer

Office 365 audit logs (Exchange). Office 365 audit logs (Exchange) record mailbox rule changes, including forwarding rules, which are critical for hunting email data exfiltration. Option A (Microsoft Defender for Cloud Apps logs) is incorrect as they monitor cloud application usage, not mailbox-level configurations. Option B (Windows Security Events) is irrelevant since they track on-premises security events. Option C (Azure AD sign-in logs) is incorrect because they capture authentication events, not mail flow or rule changes.

Answer

Microsoft Defender for Cloud Apps logs

Answer

Windows Security Events

Answer

Azure AD sign-in logs

Question 5

Refer to the exhibit. You are using a hunting query in Microsoft Defender XDR to find devices generating excessive DNS queries. The query returns many results, but you want to exclude legitimate DNS servers. What is the best approach to refine the query?

Accepted Answer

Add a `where` clause to exclude known internal DNS server IPs.. Correct answer: A. Adding a `where` clause to exclude known internal DNS server IPs reduces false positives by filtering out legitimate DNS traffic from your own DNS servers, which generate high DNS query volumes by design. Options B, C, and D are incorrect: B – Changing the RemotePort filter to UDP 53 only is already implied in a DNS query hunt and does not exclude internal servers; C – Joining with DeviceInfo may not effectively filter out DNS servers and could add complexity; D – Increasing the threshold risks missing true excessive queries that are still below the new threshold but above normal.

Answer

Join with DeviceInfo to filter by device type.

Answer

Change the RemotePort filter to UDP 53 only instead of all DNS.

Answer

Increase the count threshold to 5000.

Question 6

You are a security analyst at Contoso, a multinational company with 10,000 endpoints. You are using Microsoft Sentinel and Microsoft Defender XDR for threat hunting. In the past week, you have observed an increase in failed logon events (Event ID 4625) from multiple workstations towards a single domain controller, targeting the built-in Administrator account. The source IPs are a mix of internal and external addresses. You suspect a password spraying attack. You need to confirm the attack and identify all affected accounts. You have access to Windows Security Events ingested into Sentinel. Which single KQL query would best identify accounts with repeated failed logons across multiple source IPs, indicating password spraying?

Accepted Answer

SecurityEvent | where EventID == 4625 | summarize DistinctSourceIPs = dcount(IpAddress) by Account | where DistinctSourceIPs > 1. To identify password spraying, we need accounts targeted from multiple source IPs. Option B correctly uses summarize with dcount(IpAddress) by Account and filters where distinct source IPs > 1, indicating the same account was hit from different IPs, typical of password spraying. Option A groups by Account and IpAddress, then counts attempts, which may show high attempts from a single IP (brute-force). Option C shows total failed attempts per account regardless of source, which could be high due to many attempts from one IP. Option D only focuses on the Administrator account, missing other targeted accounts.

Answer

SecurityEvent | where EventID == 4625 | summarize FailedAttempts = count() by Account, IpAddress | where FailedAttempts > 10

Answer

SecurityEvent | where EventID == 4625 | summarize FailedAttempts = count() by Account | where FailedAttempts > 50

Answer

SecurityEvent | where EventID == 4625 and Account == 'Administrator' | summarize count() by IpAddress

Question 7

You are a security analyst at Fabrikam using Microsoft Sentinel. You are conducting a threat hunt for signs of remote code execution (RCE) via the Windows Event Log. You want to detect suspicious service creation that could indicate lateral movement. Specifically, you want to find events where a service was created (Event ID 7045) on a server, and within 5 minutes, a network connection was established from that server to another internal server. You have SecurityEvent and CommonSecurityLog tables ingested. Which KQL query should you use?

Accepted Answer

let ServiceCreation = SecurityEvent | where EventID == 7045 | project Computer, TimeGenerated; let NetworkConn = CommonSecurityLog | where DeviceAction == 'Allow' | project SourceIP, TimeGenerated; ServiceCreation | join kind=inner NetworkConn on $left.Computer == $right.SourceIP and abs(TimeGenerated - TimeGenerated) <= 5m. It uses a join with a time window to correlate service creation (EventID 7045) from SecurityEvent with network connections from CommonSecurityLog within a 5-minute timeframe. Options A, B, and C are incorrect because they do not perform a proper correlation between the two events: A uses a union, B only filters by time but does not join, and C summarizes by computer without considering the time correlation.

Answer

SecurityEvent | where EventID == 7045 | union CommonSecurityLog | where TimeGenerated > ago(1d)

Answer

SecurityEvent | where EventID == 7045 | project Computer, TimeGenerated | where TimeGenerated > ago(1h)

Answer

SecurityEvent | where EventID == 7045 | where TimeGenerated between (ago(1d) .. now()) | summarize by Computer

Question 8

You are a security analyst at Wingtip Toys using Microsoft Defender XDR. You are hunting for signs of privilege escalation via the SeDebugPrivilege abuse. You want to find processes that have enabled SeDebugPrivilege and then accessed LSASS (Event ID 10). You have DeviceProcessEvents and DeviceEvents tables available. Which advanced hunting query would best identify this pattern?

Accepted Answer

DeviceProcessEvents | where FileName in ('procexp.exe', 'procmon.exe', 'cmd.exe', 'powershell.exe') | join kind=inner (DeviceEvents | where ActionType == 'SeDebugPrivilegeEnabled') on DeviceId | join kind=inner (DeviceEvents | where ActionType == 'LsassAccess') on DeviceId. This query joins DeviceProcessEvents (filtering for process names commonly used to enable SeDebugPrivilege, such as procexp.exe) with DeviceEvents for both SeDebugPrivilegeEnabled and LsassAccess, correlated by DeviceId. This identifies processes that enabled the privilege and then accessed LSASS, matching the hunting pattern. Option A is incorrect because filtering for lsass.exe itself does not capture the processes accessing it. Option B only summarizes LsassAccess events, missing the privilege enablement step. Option C only selects DeviceId from privilege enablement events, missing LSASS access.

Answer

DeviceProcessEvents | where FileName == 'lsass.exe'

Answer

DeviceEvents | where ActionType == 'LsassAccess' | summarize by DeviceId

Answer

DeviceEvents | where ActionType == 'SeDebugPrivilegeEnabled' | project DeviceId

Question 9

Which TWO actions are essential for configuring Microsoft Sentinel to support effective threat hunting?

Accepted Answer

Connect Microsoft 365 data sources (e.g., Office 365, Entra ID, Defender for Cloud Apps). Enabling User and Entity Behavior Analytics (UEBA) provides baselines for hunting anomalies, and connecting Microsoft 365 data sources provides rich data for hunting. Customizing analytics rules is for detection, not hunting; Sysmon is not required; Watchlists are helpful but not essential for basic hunting setup.

Answer

Create a Watchlist that maps user names to email addresses

Answer

Configure custom analytics rules for every MITRE ATT&CK technique

Answer

Install Sysmon on all domain controllers

Question 10

A threat hunter wants to use Jupyter Notebooks in Microsoft Sentinel for hypothesis-driven hunting. Which THREE steps should the hunter take to set up and use this capability?

Accepted Answer

Enable Machine Learning-based analytics in Microsoft Sentinel under 'Entity behavior' settings. To set up Jupyter notebooks in Microsoft Sentinel, the hunter must first enable Machine Learning-based analytics in Sentinel under 'Entity behavior' settings to leverage ML models in notebooks (A). Next, provision an Azure Machine Learning (AML) workspace in the same subscription to host the notebook environment (B). Finally, connect Sentinel to the AML workspace using the 'Notebooks' blade to access data and run queries (D). Installing MSTICpy separately is not required because it is pre-installed in the AML workspace; notebooks primarily use KQL for queries, not PowerShell runbooks.

Answer

Install the MSTICpy Python library on each hunting analyst's workstation

Answer

Create a PowerShell runbook to automate notebook execution

Question 11

Your organization uses Microsoft Sentinel to monitor a hybrid environment consisting of on-premises servers and cloud workloads in Azure. As a threat hunter, you have been tasked with identifying potential lateral movement using pass-the-hash (PtH) attacks. You have enabled UEBA and connected Windows Event Logs, including Event ID 4624 (logon) and 4648 (explicit credentials). You need to create a hunting query that surfaces anomalous remote logons where the same account logon from a non-domain joined machine using NTLM authentication. Which KQL query should you use to start your hunt?

Accepted Answer

SecurityEvent | where EventID == 4624 and LogonType == 3 and LogonProcessName contains 'NTLM' | where TargetUserName !endswith '$' | where Computer !in (list of domain controllers) | project TimeGenerated, Account=TargetUserName, SourceWorkstation=WorkstationName, LogonProcessName. Filters for logon type 3 (network), NTLM authentication (LogonProcessName contains NTLM), and non-domain joined workstations (WorkstationName not in list of domain controllers). Option A misses PtH indicators; Option C incorrectly uses RDP logon type 10; Option D focuses on interactive logons.

Answer

SecurityEvent | where EventID == 4624 and AccountType == 'User' and LogonType == 3 | where IpAddress != '' | summarize count() by Account, IpAddress

Answer

SecurityEvent | where EventID == 4624 and LogonType == 2 and LogonProcessName contains 'NTLM' | project TimeGenerated, Account=TargetUserName

Answer

SecurityEvent | where EventID == 4624 and LogonType == 10 and AuthenticationPackageName == 'NTLM' | project TimeGenerated, Account=TargetUserName, SourceIP=IpAddress

Question 12

Your team is using Microsoft 365 Defender advanced hunting to investigate a possible data exfiltration incident. The security team suspects that an internal attacker used a compromised SharePoint Online account to download sensitive files from multiple sites. You need to build a hunting query that identifies all file download activities from SharePoint Online for a specific user account over the past 7 days, and then calculates the total size of downloaded files. Which KQL query should you use?

Accepted Answer

CloudAppEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownloaded' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize). Ly filters SharePoint file download events (FileDownloaded) and sums the FileSize. Option A uses wrong action; Option C uses wrong table; Option D is for email.

Answer

CloudAppEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownload' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize)

Answer

EmailEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownloaded' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize)

Answer

FileEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownloaded' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize)

Question 13

As a threat hunter at Contoso, you are investigating a potential advanced persistent threat (APT) that may have compromised multiple Azure subscriptions. You have Microsoft Defender for Cloud enabled and Microsoft Sentinel collecting data from all subscriptions. You suspect the attacker is using Azure Resource Manager operations to create malicious resources. You need to create a hunting query that identifies anomalous Azure management operations, specifically focusing on operations that create new resources (e.g., virtual machines, storage accounts) from unusual IP addresses or at unusual times. Which approach should you take?

Accepted Answer

Use the AzureActivity table to filter for operations where HttpMethod == 'PUT' (create/update), then summarize by CallerIpAddress and bin(TimeGenerated, 1h) to find spikes or unusual caller IPs.. The correct approach because it uses the AzureActivity table (which captures Azure Resource Manager operations) and filters for HTTP PUT (write) operations, then summarizes by caller IP and time bins to detect unusual activity. Option A is incorrect because CommonSecurityLog is used for network traffic from security appliances, not Azure management operations. Option B is inefficient as it requires manual review of all write operations without any aggregation or anomaly detection. Option D is incorrect because SigninLogs captures authentication events, not resource management operations.

Answer

Use the CommonSecurityLog table to analyze network traffic from management tools.

Answer

Use the AzureActivity table in Microsoft Sentinel to query for any operation where the OperationNameValue contains 'write' and then manually review each result.

Answer

Query the SigninLogs table in Microsoft Sentinel for all interactive sign-ins to the Azure portal, then cross-reference with Azure Activity logs.

Question 14

Your organization uses Microsoft Defender for Identity (MDI) to monitor on-premises Active Directory. As a threat hunter, you receive an alert about a potential DCSync attack. You want to hunt for any other instances of this attack across your domain controllers over the past 30 days. Which hunting query should you run in Microsoft 365 Defender advanced hunting?

Accepted Answer

IdentityDirectoryEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'. IdentityDirectoryEvents. This table captures directory service events such as directory replication, which is what a DCSync attack exploits. DCSync is a technique where an attacker impersonates a domain controller and requests replication of credentials, which is a directory service action, not a logon, query, or device event. Option A (DeviceEvents) is for endpoint activities, not directory events. Option C (IdentityLogonEvents) tracks logon attempts, not directory replication. Option D (IdentityQueryEvents) is for LDAP queries, but DCSync uses the DRSUAPI replication protocol, not queries.

Answer

DeviceEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Answer

IdentityLogonEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Answer

IdentityQueryEvents | where Timestamp > ago(30d) and ActionType == 'DCSync'

Question 15

Your team is using Microsoft Sentinel to hunt for signs of Kerberos golden ticket attacks. You have enabled Advanced Security Audit Policy on domain controllers to log Kerberos service ticket operations (Event ID 4769). You need to create a KQL query that identifies potential golden ticket use by looking for service tickets that have anomalous attributes, such as ticket encryption type 0x17 (RC4) combined with a long lifetime or unusual service names. Which KQL query should you use?

Accepted Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == '0x17' and (TicketOptions contains '0x2' or ServiceName !startswith 'krbtgt'). It filters for RC4 encryption type (0x17), which is commonly used in forged tickets, and also checks for either a long lifetime (TicketOptions contains '0x2' for renewable) or unusual service names (ServiceName does not start with 'krbtgt'). Option A only filters for encryption type without any anomaly checks, which would return too many results. Option B uses the wrong encryption type (0x12 is AES, not RC4). Option D uses EventID 4768, which is for TGT requests, not service tickets.

Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == '0x17'

Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == '0x12' and TicketOptions contains '0x2'

Answer

SecurityEvent | where EventID == 4768 and TicketEncryptionType == '0x17'