CCNA Perform threat hunting Questions

Options A and D are correct. A is correct because AADSignInEventsBeta contains Azure AD sign-ins. D is correct because IdentityLogonEvents contains on-premises AD logons.

B is incorrect because DeviceNetworkEvents is for network events. C is incorrect because EmailEvents is for email. E is incorrect because AlertInfo is for alerts.

Option A is correct because the server's Security Event ID 4624 (account logon) can be used to identify the logon session, and then the account's IP can be correlated with Azure AD SigninLogs. Option B (DeviceLogonEvents) is for Microsoft Defender for Endpoint, not on-premises servers without MDE. Option C (Sysmon) requires additional configuration.

Option D (Sentinel watchlist) is static and not suitable for dynamic correlation.

Option D is correct because the join uses inner join; if the ThreatIntelligenceIndicator table does not have any active indicators matching the remote IPs, no results are returned. Option A is wrong because the connection count threshold is reasonable. Option B is wrong because the join key is correct.

Option C is wrong because the RemoteIPType filter is correct for public IPs.

Option C is correct because the DNS connector is designed to collect DNS query logs from Windows DNS servers using AMA. Option A is wrong because Azure DNS is for Azure-hosted zones. Option B is wrong because Syslog may not parse DNS fields natively.

Option D is wrong because Windows Event Forwarding is for Windows events, not DNS logs.

Option B is correct because UEBA profiles user behavior, making 'User' the primary entity for detecting unusual access. Option A is for device-based anomalies. Option C is for IP-based anomalies.

Option D is for application anomalies.

Option D is correct because AzureHound uses the Microsoft Graph API to collect Azure AD data, and that activity is logged in AuditLogs. Option A is wrong because AzureHound does not run on VMs. Option B is wrong because it's not about networking.

Option C is wrong because AzureHound does not create storage blobs.

Option A correctly filters for EventID 4769, the specific TicketOptions and encryption type, and summarizes by AccountName. Option B uses wrong event ID. Option C uses wrong field.

Option D does not filter encryption type.

Option C is correct because the query filters for users with medium risk sign-ins and joins with service principal sign-ins on IP address, then counts occurrences per user exceeding 5, indicating potential compromise involving both user and service principal activity from the same IP. Option A is wrong because it does not focus on service principal compromise alone. Option B is wrong because it does not look for admin consent grants.

Option D is wrong because it uses only medium risk, not high.

DeviceProcessEvents contains process execution events, and SHA256 stores the hash. Option C is correct. Option A (DeviceFileEvents) is for file creation/modification, not execution.

Option B (DeviceNetworkEvents) is for network connections. Option D (DeviceEvents) is a generic table that may not include process hash.

Option A is correct because the query identifies users with high sign-in counts from specific IPs and apps, and joins with risk events to correlate with known risky users. Option B is wrong because it doesn't filter only risky users. Option C is wrong because it aggregates by user, not unique IPs.

Option D is wrong because it compares signin count to a threshold, not risk score.

Options A, C, and E are correct. Mapping hypotheses to MITRE tactics ensures coverage; using hunting queries from the Content hub provides validated queries; and documenting findings supports future hunts. Option B is incorrect because you should not only hunt for known techniques.

Option D is incorrect because you should not rely solely on automated rules.

Option B is correct because it joins sign-in events with cloud app events on user principal name and filters by app category (file sharing) and corporate IPs, which directly identifies the behavior. Option A only looks at network events, missing the sign-in context. Option C uses device info, which may not capture personal devices.

Option D uses endpoint network events, missing the app context.

Option B is correct because the command creates a new hunting query named 'Suspicious PowerShell' in the specified Microsoft Sentinel workspace. Option A is wrong because it does not run the query immediately. Option C is wrong because it does not create an analytics rule.

Option D is wrong because it does not modify an existing query.

Lateral movement often involves remote execution and credential theft. Options B and D are correct. Option A is incorrect because failed logins may indicate brute force but not necessarily lateral movement.

Option C is incorrect because port scans are reconnaissance. Option E is incorrect because file deletion is often cleanup.

Option B is correct because DeviceFileEvents captures file creation, modification, and deletion events, which are typical for ransomware encryption. Option A is wrong because it's for network connections. Option C is wrong because it's for process creation.

Option D is wrong because it's for registry modifications.

Option D is correct because Get-MpThreat retrieves threats detected by Windows Defender Antivirus; if the threat was already remediated or removed, the command may return no results. Option A is incorrect because the cmdlet exists. Option B is incorrect because admin rights are not required to query.

Option C is incorrect because the threat ID is a number.

Option C is correct because tuning the query by adding more conditions reduces false positives. Option A is wrong because increasing the time range would likely increase false positives. Option B is wrong because removing columns does not affect false positives.

Option D is wrong because creating an alert rule is for ongoing detection, not for refining the hunt.

SecurityEvent (Windows Event Logs) provides process creation and network events. DeviceNetworkEvents provides network connections. Option A is for identity only.

Option D is for DNS. Option E is for web proxy. The correct options are B and C.

Option B is correct because adding conditions to exclude known administrative scenarios (e.g., specific user accounts or command-line patterns) reduces false positives without removing the parent process filter entirely. Option A is wrong because removing the parent process filter would broaden detection, likely increasing false positives. Option C is wrong because lowering severity does not reduce false positives.

Option D is wrong because increasing time range does not help.

DeviceEvents includes various system events, including scheduled task creation via EventID 4698. DeviceProcessEvents is for processes. DeviceNetworkEvents is for network.

IdentityLogonEvents is for logons. The correct table is DeviceEvents.

Option D is correct because Office 365 audit logs capture changes to mailbox rules, including forwarding. Option A is wrong because Azure AD sign-in logs show authentication, not mail flow. Option B is wrong because Windows Security Events are for on-premises.

Option C is wrong because Microsoft Defender for Cloud Apps logs cover cloud app activity but not specifically mailbox rules.

Option A is correct because Defender for Cloud Apps can discover shadow IT cloud apps. Option B is wrong because it does not detect cloud app usage. Option C is wrong because it is for web filtering, not cloud apps.

Option D is wrong because it is for email protection.

Event ID 1102 in Windows Security log indicates the security log was cleared, which is a common technique used by attackers to cover tracks. Option A (4688) is for process creation. Option B (4624) is for successful logon.

Option D (5145) is for network share access.

Option A (where) filters for specific operations like 'Add member to role'. Option C (summarize) can count changes per user or role. Option B (project) only selects columns.

Option D (mvexpand) expands multi-valued fields. Option E (evaluate) is for plugin operators.

Options A, B, and C are correct. Option A detects connections from administrative tools (e.g., PsExec). Option B identifies anomalous PowerShell usage.

Option C detects WMI lateral movement. Option D is wrong because it focuses on third-party binaries, opposite of LotL. Option E is wrong because non-interactive logins are common for services, not specific to LotL.

Option B is correct because the query is case-sensitive and 'powershell.exe' may be invoked as 'PowerShell.exe' with different casing. Option A is plausible but less likely because the file name is often lowercase. Option C is incorrect because the JSON has correct syntax.

Option D is incorrect because the query is valid KQL.

Option B is correct because the query uses the default SigninLogs schema which includes 'Location' as a string, not 'Location' as a column. The correct column is 'LocationDetails' or the query should parse location from IP. Option A is incorrect because the rule is enabled.

Option C is incorrect because the query period and frequency are set correctly. Option D is incorrect because the query summarizes by UserPrincipalName, which is a common field.

Option B is correct because it uses a join with a time window to correlate service creation and network connection. Option A is wrong because it lacks the join. Option C is wrong because it uses a time filter on creation, not correlation.

Option D is wrong because it uses a union which is incorrect.

Option D is correct because DeviceEvents includes events like 'LsassAccessedByProcess' from the Microsoft Defender for Identity sensor. Option A (DeviceProcessEvents) records process creation, not handle open. Option B (DeviceNetworkEvents) is for network.

Option C (DeviceRegistryEvents) is for registry.

Option C is correct because DeviceProcessEvents records process creation events, and Mimikatz often appears as a process. Option A is wrong because network events are not directly related to local credential dumping. Option B is wrong because registry events may show persistence but not the dumping itself.

Option D is wrong because file creation events are less direct for process-based tools.

Options B and D are correct because file hashes and IP addresses are standard IOCs. Option A is wrong because usernames are not IOCs; they are artifacts. Option C is wrong because device names are not IOCs.

Option E is wrong because registry keys can be IOCs but are less common than hashes and IPs.

Option B is correct because Microsoft Sentinel's Threat Intelligence integration allows importing TI indicators and creating analytics rules. Option A is wrong because UEBA focuses on user behavior, not specific TI. Option C is wrong because workbook is for visualization, not detection.

Option D is wrong because playbook is for response automation.

Options A, B, and D are correct. Option A: you can create custom activity policies to detect anomalies. Option B: IP address ranges can be used to define trusted locations.

Option D: User investigation allows examining user activities. Option C is wrong because custom detections in Microsoft Sentinel are not part of Defender for Cloud Apps. Option E is wrong because hunting queries are in Microsoft Defender for Endpoint, not Cloud Apps.

Option D is correct because it filters EventID and then excludes 'SYSTEM' account. Option A is wrong because it uses '!=' incorrectly. Option B is wrong because 'not' without parentheses may cause syntax error.

Option C is wrong because 'equals' is not a KQL operator.

Option A is correct because CloudAppEvents contains location data (CountryCode or IPLocation). By summarizing per user and bin by time, you can group activities by user and time window, then filter for those with multiple distinct countries. Option B is incorrect because SecurityAlert contains alerts, not raw events.

Option C is incorrect because OfficeActivity only covers Office 365, not all cloud apps. Option D is incorrect because CommonSecurityLog is for on-premises network devices, not cloud apps.

Option A correctly filters for long query names, summarizes distinct ResponseIPs per ClientIP, and orders by dcount. Option B counts all responses, not unique. Option C uses wrong field.

Option D does not filter length.

Using KQL to query CloudAppEvents for the specific SharePoint site and filtering by IP address categories (e.g., AnonymousProxy) is the most direct method. Option A (Azure AD sign-in logs) may not include SharePoint site-level access. Option B (Microsoft Defender for Endpoint) is for endpoint activities.

Option D (Microsoft Purview) focuses on data classification and governance.

Option B is correct because dcount is an approximate distinct count that is efficient for large datasets. Option A is wrong because count counts all events, not distinct accounts. Option C is wrong because distinct is used to return unique rows, not to count.

Option D is wrong because summarize with count() counts all rows.

Option C is correct because DeviceProcessEvents captures process creation events, which directly indicate malware execution. Option A is incorrect because EmailEvents only covers email, not execution. Option B is incorrect because DeviceNetworkEvents shows network connections after execution.

Option D is incorrect because IdentityLogonEvents focuses on authentication.

Option D (use the Activity log to search for app installations and then investigate using App Governance or Cloud App Security) is correct because it first identifies the app via installations and then uses app analytics to scope all instances. Option A (conditional access policy) is reactive and not hunting. Option B (alerts) only catches known threats.

Option C (OAuth apps page) can list apps but may not show all historical installations; activity log is more comprehensive for hunting.

Option A is correct because it counts distinct UserId per IP and filters for high counts. Option B is wrong because it counts total attempts, not distinct users. Option C is wrong because it groups by UserId, not IP.

Option D is wrong because it counts distinct IPs per user, the opposite of what is needed.

Option B is correct because base64-encoded command lines are commonly used in malicious documents to obfuscate payloads. Decoding the argument reveals the intended command. Option A is incorrect because decoding is not limited to PowerShell.

Option C is incorrect because network traffic analysis may follow but is not the immediate next step. Option D is incorrect because file hash lookup is less relevant for the encoded command.

Option D is correct because the query joins cmd.exe executions containing 'powershell' with network connections to port 443 on the same device, indicating possible PowerShell download cradles. Option A is wrong because the query does not inspect process integrity levels. Option B is wrong because the query focuses on cmd.exe, not generic script execution.

Option C is wrong because the query is not limited to lateral movement; it targets command and control activity.

Option A is correct because the Threat Explorer allows investigation of email threats and manual submissions. Option B is wrong because the Attack Simulator is for conducting simulated attacks. Option C is wrong because the Security & Compliance Center's email trace is for message flow, not deep threat analysis.

Option D is wrong because the Quarantine portal is for managing quarantined messages, not submitting for analysis.

Effective hunting includes using known IOCs, behavioral baselines, and anomaly detection. Options B, C, and E are correct. Option A is incorrect because alerts are reactive.

Option D is incorrect because a single event is not sufficient.

Option A is correct because SecurityEvents (Windows Event Logs) contain events like 4688 (process creation) and 4689 (process termination) which can show attempts to stop security services. Option B is incorrect because CommonSecurityLog is for firewall logs. Option C is incorrect because Syslog is for Linux events.

Option D is incorrect because OfficeActivity is for Office 365.

Option A is correct because it joins process creation with privilege enablement and LSASS access. Option B is wrong because it only checks privilege enablement. Option C is wrong because it only checks LSASS access.

Option D is wrong because it filters by process name, missing other processes.

Option A is correct because CommonSecurityLog contains network traffic logs from security appliances. Option B is for Windows events, not network. Option C is for DNS queries.

Option D is for device events from Defender for Endpoint, but not IP communications.

The query uses ipv4_lookup with a static lookup table 'solorigate_ips', but this function expects a parameter for the lookup data source. The correct syntax should reference a table or inline list. Option A is incorrect because the function exists.

Option C is incorrect because the query scans the entire DeviceEvents table. Option D is incorrect because there is no syntax error with ActionType.

Option A (RemoteIP) is the destination IP of the DNS server; not the queried domain. Option B (RemoteUrl) contains the domain name being queried. Option C (InitiatingProcessFileName) shows which process made the query.

Option D (Timestamp) is essential for time patterns. Option E (ActionType) indicates if it's a DNS query. Correct: RemoteUrl, InitiatingProcessFileName, Timestamp.

ActionType is not a column in DeviceNetworkEvents for DNS; it's in DeviceEvents.

Options A, B, and E are correct. A: Data retention policies affect how far back you can hunt. B: Understanding data sources ensures you use the right tables.

E: OpSec is critical to avoid alerting adversaries. Option C is wrong because hunting often requires custom queries, not just built-in rules. Option D is wrong because MFA is an identity protection measure, not a hunting consideration.

Option B is correct because filtering before expanding reduces the dataset size. Option A is wrong because materializing entire table is inefficient. Option C is wrong because increasing nodes may not help if the dataset is too large.

Option D is wrong because reducing nodes starves resources.

Option B is correct because session replay allows you to reconstruct the sequence of events and identify lateral movement patterns. Option A is wrong because timeline correlation might miss the specific sequence. Option C is wrong because anomaly detection alone doesn't link the events.

Option D is wrong because it's a detection, not hunting.

Option A is correct because it looks for certutil.exe with a URL parameter in the command line. Option B is wrong because it looks for mshta.exe. Option C is wrong because it looks for wscript.exe.

Option D is wrong because it looks for powershell.exe.

Option A correctly filters for low to high integrity transitions and counts per device. Option B uses wrong integrity levels. Option C does not filter by integrity.

Option D uses wrong fields.

Options B and D are correct. Option B: Using watchlists to store known indicators helps in matching. Option D: Creating custom hunting queries is essential for proactive hunting.

Option A is wrong because disabling alerts would miss possible incidents. Option C is wrong because deleting data reduces hunting scope. Option E is wrong because manual analysis is necessary alongside automation.

Option A is correct because adding a condition to exclude management jump boxes that use NTLM would remove known legitimate activity. Option B is wrong because changing logon type to 10 (remote interactive) would exclude many legitimate RDP connections. Option C is wrong because removing the NTLM filter would include all authentication packages, increasing false positives.

Option D is wrong because the query already uses SecurityEvent; switching to Event table would not help.

Option A is correct because Event ID 4624 (successful logon) with LogonType 3 (network) can indicate PtH if paired with unusual source IP. Option B (4776) is for credential validation but not necessarily PtH. Option C (4648) is for explicit credentials.

Option D (4672) is for special privileges.

Kerberoasting involves requesting TGS tickets for SPNs. Option D is correct because SecurityEvent 4769 logs TGS requests, and TicketEncryptionType 0x17 indicates RC4 encryption used in Kerberoasting. Option A is incorrect because Event 4768 is for TGT requests.

Option B is incorrect because DeviceLogonEvents may not contain SPN details. Option C is incorrect because DeviceEvents may not capture this security event.

Option A is correct because filtering out known corporate IP ranges and common applications helps isolate anomalous single logons. Option B removes all single logons. Option C filters too broadly.

Option D may miss external logons.

Options A and D are correct. Process injection is a classic technique to hide malicious code within legitimate processes. DLL sideloading exploits legitimate application load order to run malicious DLLs.

Option B is incorrect because strong passwords are a defense, not an attack technique. Option C is incorrect because MFA is a security control, not a bypass. Option E is incorrect because software updates are mitigation, not an attack.

Option B is correct because the Bookmarks tab allows you to save and annotate events. Option A is for query results. Option C is for saved queries.

Option D is for entity pages.

Option D is correct because the behavior analytics function in KQL is used to detect anomalies based on UEBA profiles. Option A is for summarization. Option B is for time series decomposition.

Option C is for data summarization.

Option A is correct because the `workspace()` function in KQL allows cross-workspace queries. Option B is wrong because cross-resource queries use `workspace()`, not `union()`. Option C is wrong because `join` is used to combine tables, not workspaces.

Option D is wrong because `externaldata` is for external data sources.

The summarize operator with sum() aggregation computes total bytes per source IP, and top 10 limits to the top results. Option A is correct. Option B (where) filters but does not aggregate.

Option C (project) only selects columns. Option D (extend) adds computed columns without aggregation.