SC-200 Perform threat hunting Practice Test 9 — 15 Questions

Question 1

A threat hunter is investigating a potential malware outbreak in Microsoft Defender for Cloud Apps. The hunter notices that multiple users have installed a new app with high permissions that accesses their email. The app was not requested by IT. What is the most effective way to hunt for all instances of this app across the organization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Cloud App Security activity log to search for 'Install app' events and then review the 'App governance' dashboard for all instances. The activity log in Cloud App Security provides a comprehensive record of app installation events, and the App Governance dashboard aggregates all instances for review, making it the most effective hunting approach. Option A (conditional access policies) is reactive and not suitable for proactive hunting. Option B (Microsoft 365 Defender alerts) only surfaces known malicious apps, not all instances. Option C (CloudAppEvents table and AppGovernance) can be used, but the activity log is more direct and complete for hunting all installations, as CloudAppEvents may not capture every installation event or may require complex queries.

Answer

Review Conditional Access app control policies for any block rules

Answer

Check Microsoft 365 Defender alerts for malicious OAuth apps

Answer

Query the Microsoft 365 Defender advanced hunting table 'CloudAppEvents' for app installation events and then use 'AppGovernance' to list all apps

Question 2

A threat hunter is using Microsoft Sentinel and Microsoft Defender XDR to hunt for a potential cross-domain attack where an attacker compromised an on-premises server and then used a privileged account to sign into Microsoft 365 from a new IP. The hunter wants to identify the server using a query that combines Windows Event Logs from the server with Microsoft 365 sign-in logs. Which approach should the hunter take to correlate the data?

Accepted Answer

Ingest Windows Security Event logs (Event ID 4624) from the server into a Log Analytics workspace, and join with SigninLogs on account name and timestamp. To correlate on-premises Windows logons with Microsoft 365 sign-ins, the hunter must ingest Windows Security Event ID 4624 (successful logon) from the server into a Log Analytics workspace, then join with the SigninLogs table on account name and timestamp. This is the standard Sentinel correlation pattern for cross-domain attacks. Event ID 4624 captures the account and logon type, enabling linkage to cloud sign-ins.

Answer

Create a Sentinel watchlist of known attacker IPs and compare with server logs

Answer

Enable Sysmon on the server and use its Event ID 3 (network connection) to find the IP

Answer

Use the DeviceLogonEvents table in Microsoft Defender XDR advanced hunting

Question 3

A threat hunter wants to proactively search for signs of ransomware activity in the environment using Microsoft Sentinel. Which data source is most likely to provide early indicators of ransomware, such as mass file renaming or encryption?

Accepted Answer

Microsoft Defender for Endpoint advanced hunting tables like DeviceFileEvents and DeviceProcessEvents. (Microsoft Defender for Endpoint) provides advanced hunting on endpoint processes and file events, which can detect mass file modifications indicative of ransomware. Option A (Microsoft Entra ID sign-in logs) logs authentication events. Option C (Azure Activity Log) logs control plane operations. Option D (Office 365 audit logs) logs cloud app activities.

Answer

Azure AD sign-in logs

Answer

Azure Activity Log

Answer

Office 365 audit logs (UnifiedAuditLog)

Question 4

During a threat hunt, an analyst discovers a PowerShell script that was executed on multiple servers in the environment. The script connects to an external IP address and downloads a payload. The analyst wants to find all other servers that may have been compromised by the same script. What is the most efficient way to search for this across the environment?

Accepted Answer

Use the DeviceProcessEvents table in Microsoft Defender for Endpoint advanced hunting to search for the script's SHA256 hash or command line pattern. It leverages Microsoft Defender for Endpoint's advanced hunting to centrally search for the script's SHA256 hash or command line pattern across all endpoints. Option A is incorrect because Sysmon may not be installed on all servers, and querying each server individually is inefficient. Option B is incorrect because network logs only show network connections and do not provide process execution details. Option D is incorrect because querying Event ID 4104 requires enabling PowerShell script block logging and accessing each server individually, which is less efficient than centralized hunting.

Answer

Use Sysmon Event ID 1 (process creation) to find PowerShell executions

Answer

Review the network logs from the firewall for connections to the external IP

Answer

Query the Windows Event Log for Event ID 4104 (PowerShell script block logging) on each server

Question 5

A threat hunter is using Microsoft Sentinel to hunt for a potential advanced persistent threat (APT) that is using living-off-the-land binaries (LOLBins). The hunter creates a KQL query that lists all instances of certutil.exe making network connections. The query returns many legitimate results. What is the best way to reduce false positives while still detecting malicious use?

Accepted Answer

Add additional filters to the query to detect only certutil.exe processes with suspicious command-line arguments (e.g., '-urlcache' or '-split'). Malicious use of certutil.exe as a LOLBin often involves specific command-line arguments such as '-urlcache' or '-split' to download or encode data. By adding these filters to the KQL query, the hunter can reduce false positives from legitimate certutil.exe network connections while still capturing suspicious activity. Option A (Sysmon Event ID 3) still returns all network connections and does not filter on arguments, so it does not reduce false positives. Option B would miss potential threats. Option C expands the query to include all LOLBins, which increases noise and does not target the specific binary in question.

Answer

Replace the query with a Sysmon Event ID 3 (network connect) filter for certutil.exe

Answer

Remove certutil.exe from the hunting query and focus on other binaries

Answer

Expand the query to include all LOLBins that make network connections

Question 6

During a threat hunt, you discover that a PowerShell script executed on multiple servers and established outbound connections to an external IP address. Which data source should you query in Microsoft Defender XDR to identify the specific command-line arguments used?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents in Microsoft Defender XDR contains detailed information about process creation, including the command-line arguments used when a process was started. Querying this table will reveal the specific arguments passed to the PowerShell script. This is the correct data source for command-line details.

Answer

DeviceEvents

Answer

DeviceImageLoadEvents

Answer

DeviceNetworkEvents

Question 7

You are threat hunting for signs of credential dumping via LSASS access. Which Advanced Hunting schema table in Microsoft Defender XDR should you primarily query to find processes that opened a handle to LSASS?

Accepted Answer

DeviceEvents. DeviceEvents is the correct table because it captures a broad set of endpoint telemetry including process access events, which is where LSASS handle-opening activity is recorded. When a tool like Mimikatz or a credential-dumping utility opens a handle to lsass.exe with read access, that action surfaces in DeviceEvents with ActionType values such as 'ProcessAccess' and fields identifying the source and target processes. DeviceProcessEvents only records process creation, so it would not show the handle open itself.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 8

Your threat hunt involves correlating alerts from Microsoft Defender for Cloud Apps with Microsoft Defender for Endpoint. Which Microsoft Sentinel integration should you use to unify these alerts for hunting?

Accepted Answer

Microsoft Sentinel's unified analytics rules and incident creation. Microsoft Sentinel provides built-in connectors and analytics rules to correlate alerts across Microsoft Defender XDR, including Defender for Cloud Apps and Defender for Endpoint. Option B (Power Automate) can automate workflows but does not provide a unified hunting experience or correlation. Option C (Microsoft Graph API) is programmatic and can retrieve alerts, but it is not a unified correlation tool. Option D (Azure Monitor Workbooks) visualizes data but does not correlate or unify alerts for hunting.

Answer

Power Automate flows to merge alerts

Answer

Microsoft Graph API to pull alerts into a custom database

Answer

Azure Monitor Workbooks to display alerts side by side

Question 9

You need to create a custom detection rule in Microsoft Sentinel that alerts when an anomalous number of failed logons occur from a single IP address within 5 minutes. Which KQL operator should you use to count failed logons per IP?

Accepted Answer

summarize. 'summarize' is used to aggregate counts per key (IP). Option B (project) only selects columns. Option C (where) filters rows. Option D (extend) adds calculated columns.

Answer

project

Answer

where

Answer

extend

Question 10

Which TWO data sources are most relevant for threat hunting for lateral movement using remote service creation (e.g., WMI, PsExec)?

Accepted Answer

DeviceNetworkEvents. Correct options: C and E. DeviceProcessEvents captures process creation on remote machines (e.g., services.exe, cmd.exe) which is indicative of remote service creation via WMI or PsExec. DeviceNetworkEvents captures outbound network connections to high ports (e.g., 135, 445) on remote machines. Option A (DeviceRegistryEvents) captures registry modifications, not directly relevant. Option B (DeviceEvents) is less specific for this scenario. Option D (DeviceFileEvents) captures file writes, not process execution.

Answer

DeviceRegistryEvents

Answer

DeviceEvents

Answer

DeviceFileEvents

Question 11

Which THREE techniques would you use in Microsoft Sentinel to hunt for data exfiltration over DNS?

Accepted Answer

Analyze DNS query logs for high volume or long subdomains. Option A is correct because DNS tunneling and exfiltration typically manifest as unusually high query volumes to a single domain or abnormally long subdomain labels that encode stolen data, so analyzing DNS query logs for these patterns is a core hunting technique in Microsoft Sentinel. Option C is correct because correlating DNS events with process creation events (for example via SecurityEvent 4688 or Sysmon Event ID 1) lets you identify which executable or script is generating the suspicious queries, distinguishing malicious tooling from legitimate resolvers. Option E is correct because ASIM (Advanced Security Information Model) DNS parsers normalize DNS logs from multiple sources into a common schema, enabling consistent anomaly detection and cross-source correlation across the workspace. Option B is not part of DNS exfiltration hunting since it focuses on large transfers to cloud storage IPs, which is HTTP/HTTPS exfiltration rather than DNS-based. Option D is also unrelated, as email forwarding rules address exfiltration via email (for example Exchange transport rules) and not DNS tunneling.

Answer

Examine network traffic logs for large data transfers to known cloud storage IPs

Answer

Review email forwarding rules for external domains

Question 12

Which TWO built-in Microsoft Sentinel hunting queries are useful for detecting signs of compromised credentials?

Accepted Answer

Anomalous logon location. Option B, 'Anomalous logon location,' is correct because it flags authentication events where a user signs in from an unusual or unexpected geographic location, which is a classic indicator that credentials have been stolen and are being used by an attacker from a different region. Option C, 'Brute force attempt against user accounts,' is correct because it detects repeated failed authentication attempts followed by a success, directly surfacing password-guessing activity that results in compromised credentials. Option A, 'Baseline of user behavior,' is a general behavioral analytics query that establishes normal activity patterns rather than specifically detecting credential compromise. Option D, 'Deleted user account,' relates to account lifecycle or destructive actions, not credential theft. Option E, 'New user account creation,' indicates persistence or privilege escalation via a newly created account, not the compromise of existing credentials.

Answer

Baseline of user behavior

Answer

Deleted user account

Answer

New user account creation

Question 13

During a threat hunt, you discover a suspicious PowerShell command that decoded a base64 string and executed a script. Which Microsoft Defender for Endpoint advanced hunting table should you query to find the decoded command line?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents in Microsoft Defender for Endpoint advanced hunting contains process creation events, including the full command line used to launch processes. Since the suspicious PowerShell command executed a script, the decoded command line would be captured in this table under the ProcessCommandLine column.

Answer

IdentityLogonEvents

Answer

DeviceNetworkEvents

Answer

DeviceEvents

Question 14

A threat hunter wants to use Microsoft Sentinel's UEBA to identify anomalous behavior. Which data connector must be enabled to provide the necessary Azure Active Directory (now Microsoft Entra ID) sign-in logs for UEBA?

Accepted Answer

Microsoft Entra ID. UEBA in Microsoft Sentinel requires sign-in logs to detect anomalous behavior. The Microsoft Entra ID connector (option C) provides these sign-in logs from Microsoft Entra ID/Entra ID. Option A (Office 365) provides Exchange, Teams, and SharePoint logs, but not sign-in logs. Option B (Microsoft Entra ID Audit) provides only audit logs, not sign-in events. Option D (Windows Security Events via AMA) provides security event logs from Windows machines, which do not contain cloud sign-in data. Therefore, the Microsoft Entra ID connector is the correct choice.

Answer

Office 365

Answer

Microsoft Entra ID Audit

Answer

Windows Security Events via AMA

Question 15

To hunt for malicious PowerShell encoded commands, which columns in the DeviceProcessEvents table in Microsoft 365 Defender advanced hunting should you focus on?

Accepted Answer

ProcessCommandLine. Encoded PowerShell commands (e.g., -EncodedCommand or -enc) appear in the full command line used to launch the process, which is captured in the ProcessCommandLine column of DeviceProcessEvents. Filtering or searching ProcessCommandLine for base64-like strings or the -enc switch is the standard hunting technique for detecting obfuscated PowerShell execution.

Answer

DeviceName

Answer

FileName

Answer

InitiatingProcessFileName