SC-200 Perform threat hunting Practice Question
A security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to detect when a user account has been used to log in from an unusual location and then immediately performs a password reset for another user. Which hunting approach is most effective for this scenario?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Write a KQL query that joins SigninLogs with AuditLogs on user principal name and times within a short window
(KQL query using join between two tables) is correct because it allows correlating login events from SigninLogs with password reset events from AuditLogs, combining the two conditions. Option A (playbook) is for automated response, not hunting. Option C (searching only SigninLogs) cannot correlate with password reset events. Option D (watchlist) provides static data, not real-time correlation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a Microsoft Sentinel playbook to automatically flag any password reset
Why it's wrong here
Playbooks are for automation, not hunting.
- ✓
Write a KQL query that joins SigninLogs with AuditLogs on user principal name and times within a short window
Why this is correct
This correlates the two events to detect the sequence of unusual login followed by password reset.
- ✗
Search the SigninLogs table for logins from unusual locations
Why it's wrong here
This only addresses one part of the scenario and does not correlate with password resets.
- ✗
Create a watchlist of known unusual locations and use it in a query against AuditLogs
Why it's wrong here
Watchlists are static and do not correlate different event types.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.