SC-200 Perform threat hunting Practice Question
As a threat hunter, you want to proactively search for signs of privilege escalation using the 'AzureHound' tool within your Microsoft Sentinel environment. Which data source is most relevant to ingest to detect AzureHound usage?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Audit Logs (now Microsoft Entra ID Audit Logs)
AzureHound queries the Microsoft Graph API to gather Microsoft Entra ID data, and those API calls are logged in the Microsoft Entra ID Audit Logs (Microsoft Entra ID Audit Logs). Option A is incorrect because AzureHound does not run on VMs; it is a standalone tool that uses Graph API. Option C is incorrect because AzureHound does not interact with Azure Storage. Option D is incorrect because Azure Network Watcher logs do not capture Microsoft Entra ID API activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VM Insights logs
Why it's wrong here
AzureHound queries Microsoft Entra ID via the Graph API to enumerate users, groups and roles for privilege-escalation paths. VM Insights logs capture guest OS performance and process telemetry, not directory API calls. Entra ID audit and sign-in logs are the relevant source for detecting this enumeration.
- ✓
Microsoft Entra ID Audit Logs (now Microsoft Entra ID Audit Logs)
Why this is correct
AzureHound enumerates Microsoft Entra ID objects, users, groups and role assignments via the Graph API, so Microsoft Entra ID Audit Logs capture the directory read and consent activity that reveals enumeration. These logs expose the reconnaissance patterns AzureHound generates.
- ✗
Azure Storage analytics logs
Why it's wrong here
AzureHound enumerates Microsoft Entra ID objects through Graph API calls; it never touches blob, file or queue endpoints. Storage analytics logs record data-plane operations against storage accounts, so directory enumeration leaves no trace. Entra ID audit logs capture the relevant API activity.
- ✗
Azure Network Watcher logs
Why it's wrong here
AzureHound operates entirely through Microsoft Entra ID Graph API calls, leaving no distinctive network-flow signature. Network Watcher logs capture IP flows, NSG and connectivity data, so directory enumeration activity is invisible there. Entra ID audit logs record the Graph requests AzureHound generates.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.