CCNA Perform threat hunting Questions

MCQmedium

As a threat hunter, you want to proactively search for signs of privilege escalation using the 'AzureHound' tool within your Microsoft Sentinel environment. Which data source is most relevant to ingest to detect AzureHound usage?

A.Azure VM Insights logs

B.Azure Active Directory Audit Logs (now Microsoft Entra ID Audit Logs)

C.Azure Storage analytics logs

D.Azure Network Watcher logs

AnswerB

AzureHound queries Microsoft Graph, and audit logs capture those API calls.

Why this answer

AzureHound queries the Microsoft Graph API to gather Azure AD data, and those API calls are logged in the Azure Active Directory Audit Logs (Microsoft Entra ID Audit Logs). Option A is incorrect because AzureHound does not run on VMs; it is a standalone tool that uses Graph API. Option C is incorrect because AzureHound does not interact with Azure Storage.

Option D is incorrect because Azure Network Watcher logs do not capture Azure AD API activity.

Practice this question →

MCQhard

A threat hunter is investigating a potential data exfiltration incident. The hunter suspects that a user is using an unauthorized cloud storage service. Which Microsoft Defender for Cloud Apps signal would be most useful to detect this activity?

A.Cloud Discovery

B.Microsoft Defender for Endpoint Web Protection

C.Microsoft Defender for Identity

D.Microsoft Defender for Office 365 Safe Links

AnswerA

Cloud Discovery identifies shadow IT and cloud app usage.

Why this answer

Defender for Cloud Apps can discover shadow IT cloud apps. Option B is wrong because it does not detect cloud app usage. Option C is wrong because it is for web filtering, not cloud apps.

Option D is wrong because it is for email protection.

Practice this question →

MCQmedium

During a threat hunt, a security analyst uses Microsoft Sentinel and identifies a series of failed logon attempts from a single IP address targeting multiple user accounts. The analyst wants to create a scheduled analytics rule that generates an alert when the same IP address fails to logon to more than 10 different accounts within 5 minutes. Which KQL operator should be used to count distinct accounts per IP?

A.count()

B.summarize count() by Account

C.distinct Account

D.dcount(Account)

AnswerD

dcount provides an approximate distinct count of accounts, suitable for performance.

Why this answer

Dcount(Account). The dcount() function performs an approximate distinct count, which is efficient for large datasets and suitable for counting distinct accounts per IP. Option A (count()) counts all events, not distinct accounts.

Option B (summarize count() by Account) counts events per account, not distinct accounts per IP. Option C (distinct Account) returns unique account values but does not provide a count.

Practice this question →

MCQhard

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You are hunting for a threat that uses 'process hollowing' to evade detection. Which advanced hunting query in Microsoft Defender for Endpoint would be most effective?

A.DeviceProcessEvents | where InitiatingProcessFileName != ImageFileName | where ParentProcessFileName != ImageFileName

B.DeviceProcessEvents | where FileName in~ ('rundll32.exe', 'regsvr32.exe', 'mshta.exe')

C.DeviceFileEvents | where FileName contains 'hollow'

D.AlertInfo | where Title contains 'Process hollowing'

AnswerA

Process hollowing typically involves a process where the original image is replaced; this query finds mismatches between initiating, parent, and image file names.

Why this answer

Process hollowing often involves a child process with a different parent image; DeviceProcessEvents can show such anomalies. Option B is wrong because it looks for specific image names. Option C is wrong because file events are less direct.

Option D is wrong because it waits for alerts.

Practice this question →

MCQmedium

Your threat hunting hypothesis is that a user's credentials were used to sign in from two geographically distant locations within a short time. In Microsoft Defender for Cloud Apps, which log type would you query in Microsoft Sentinel to detect impossible travel?

A.SigninLogs

B.AuditLogs

C.CommonSecurityLog

D.OfficeActivity

AnswerA

SigninLogs record user sign-in events with location and time.

Why this answer

SigninLogs contain user sign-in activities with IP address and timestamp, essential for detecting impossible travel.

Practice this question →

MCQeasy

You are threat hunting for credential dumping activity. Which Windows event ID is commonly associated with the use of tools like Mimikatz?

A.4624 (Successful Logon)

B.4768 (Kerberos Authentication Ticket Request)

C.4688 (Process Creation)

D.4672 (Special Logon)

AnswerC

Process creation events can show when Mimikatz or similar tools are launched.

Why this answer

Windows Event ID 4688 (Process Creation) logs every new process spawned on the system, including the execution of tools like Mimikatz. When Mimikatz runs, it creates a process (e.g., mimikatz.exe), and the 4688 event captures the command line, parent process, and user context, which are critical for detecting credential dumping activity.

Exam trap

Microsoft often tests the misconception that credential dumping is tied to authentication events (like 4624 or 4768), but the key indicator is the process creation event (4688) that captures the execution of the dumping tool itself.

How to eliminate wrong answers

Option A is wrong because Event ID 4624 (Successful Logon) records authentication events, not the execution of a process like Mimikatz; credential dumping occurs after logon, not during it. Option B is wrong because Event ID 4768 (Kerberos Authentication Ticket Request) tracks TGT requests to a domain controller, which is unrelated to local credential dumping via Mimikatz. Option D is wrong because Event ID 4672 (Special Logon) logs when a user is granted special privileges (e.g., SeTcbPrivilege), but it does not directly indicate process creation or execution of a credential dumping tool.

Practice this question →

MCQeasy

A security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to detect when a user account has been used to log in from an unusual location and then immediately performs a password reset for another user. Which hunting approach is most effective for this scenario?

A.Use a Microsoft Sentinel playbook to automatically flag any password reset

B.Write a KQL query that joins SigninLogs with AuditLogs on user principal name and times within a short window

C.Search the SigninLogs table for logins from unusual locations

D.Create a watchlist of known unusual locations and use it in a query against AuditLogs

AnswerB

This correlates the two events to detect the sequence of unusual login followed by password reset.

Why this answer

(KQL query using join between two tables) is correct because it allows correlating login events from SigninLogs with password reset events from AuditLogs, combining the two conditions. Option A (playbook) is for automated response, not hunting. Option C (searching only SigninLogs) cannot correlate with password reset events.

Option D (watchlist) provides static data, not real-time correlation.

Practice this question →