SC-200 Perform threat hunting Practice Question
As a threat hunter, you want to proactively search for signs of privilege escalation using the 'AzureHound' tool within your Microsoft Sentinel environment. Which data source is most relevant to ingest to detect AzureHound usage?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Active Directory Audit Logs (now Microsoft Entra ID Audit Logs)
AzureHound queries the Microsoft Graph API to gather Azure AD data, and those API calls are logged in the Azure Active Directory Audit Logs (Microsoft Entra ID Audit Logs). Option A is incorrect because AzureHound does not run on VMs; it is a standalone tool that uses Graph API. Option C is incorrect because AzureHound does not interact with Azure Storage. Option D is incorrect because Azure Network Watcher logs do not capture Azure AD API activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VM Insights logs
Why it's wrong here
AzureHound is a .NET tool that runs on a machine but its activities are against Azure AD, not VM logs.
- ✓
Azure Active Directory Audit Logs (now Microsoft Entra ID Audit Logs)
Why this is correct
AzureHound queries Microsoft Graph, and audit logs capture those API calls.
- ✗
Azure Storage analytics logs
Why it's wrong here
Storage logs are irrelevant for Azure AD reconnaissance.
- ✗
Azure Network Watcher logs
Why it's wrong here
Network logs won't capture Graph API calls.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.