CCNA Perform threat hunting Questions

Option D is correct because Attack Surface Reduction (ASR) rules can block suspicious behavior. Option A (Custom file indicators) blocks based on known IOCs. Option B (Network Protection) blocks network connections.

Option C (Web Protection) blocks web traffic.

Option A is correct because mass file encryption or renaming is a direct sign of ransomware. Option B is wrong because while shadow copy deletion is common after ransomware, it can also be done by legitimate tools. Option C is wrong because large file downloads can be benign.

Option D is wrong because scheduled task creation is common for persistence but not specific to ransomware.

Option B is correct because adding allowlist conditions, such as excluding known administrative tools or approved remote management traffic, directly reduces false positives without removing the core logic. Option A is wrong because reducing the time range may miss true positives. Option C is wrong because the question asks to maintain detection coverage, and using a less sensitive data source would reduce coverage.

Option D is wrong because increasing the threshold may also miss true positives.

The investigation graph in Microsoft Sentinel allows visual pivoting and exploration of entities. Option A is correct because it provides a graphical view of connections between entities. Option B is incorrect because the incidents blade shows incidents but not entity relationships.

Option C is incorrect because playbooks automate responses. Option D is incorrect because workbooks are for dashboards.

Option D is correct because granting OAuth permissions is a key indicator of potential abuse. Option A is wrong because file downloads are not directly related to OAuth permissions. Option B is wrong because mailbox forwarding is an email rule, not OAuth.

Option C is wrong because logon failures are authentication events.

The IP address is the key entity linking the sign-ins. Option C is correct. Option A is incorrect because the user is a target, not the pivot.

Option B is incorrect because the device may be compromised but is not the initial pivot. Option D is incorrect because the application is secondary.

The query uses 'or' incorrectly; the condition 'ProcessCommandLine contains 'System.Net.WebClient'' is evaluated separately from the FileName condition, so it would match any process with WebClient, not just PowerShell. Option A: 'contains' is correct for substring. Option B: 'and' would make it too restrictive.

Option C: The connector is fine. The correct answer is D: the logical operator precedence is wrong.

Option D is correct because the `DeviceNetworkEvents` table in Microsoft Defender XDR logs network connections, and filtering for RDP port 3389 with a count of distinct destination IPs over a threshold helps identify unusual RDP patterns. Option A is wrong because `DeviceProcessEvents` logs process creation, not network connections. Option B is wrong because `DeviceLogonEvents` logs authentication events, not network connections.

Option C is wrong because `DeviceRegistryEvents` logs registry changes.

Option B is correct because golden ticket attacks often involve anomalous Kerberos service ticket requests that are not preceded by an authentication request. MDI generates alerts for such anomalies, which are stored in the SecurityAlert table. Option A is incorrect because DeviceProcessEvents is for endpoints, not authentication servers.

Option C is incorrect because IdentityLogonEvents may contain logon events but not specifically golden ticket indicators. Option D is incorrect because CommonSecurityLog is for network devices.

Option C is correct because Windows Security Events from domain controllers include Event ID 4625 (failed logon) necessary for brute-force hunting. Option A is wrong because Azure Activity Log does not include on-premises authentication. Option B is wrong because Microsoft 365 Defender events focus on cloud identities.

Option D is wrong because Syslog typically contains network device logs, not Windows authentication.

Option C is correct because 'search' can scan across tables for a pattern, but for process ancestry queries, joining DeviceProcessEvents with DeviceEvents is common. However, the best approach is to use 'let' to define a lookup and then use 'join'. The question expects knowledge of 'search' as a broad tool.

Option A is wrong because 'union' combines tables, not specifically parent-child relationships. Option B is wrong because 'find' searches across tables but is less efficient. Option D is wrong because 'evaluate' is for plugin execution.

Option B (KQL query using join between two tables) is correct because it allows correlating login events from one table with password reset events from another table, combining the two conditions. Option A (single table) cannot correlate two different event types. Option C (watchlist) is for static data, not real-time correlation.

Option D (playbook) is for automated response, not hunting.

Option B is correct because the DNS connector in Microsoft Sentinel ingests DNS query logs from Windows DNS servers, which can be used to detect domain resolutions. Option A is wrong because the Windows Security Events connector focuses on security events like logons. Option C is wrong because the Azure Activity connector logs Azure resource operations, not DNS queries.

Option D is wrong because Office 365 connector ingests audit logs, not DNS.

DeviceProcessEvents stores process creation events including command lines. DeviceEvents stores raw events but not command lines. DeviceNetworkEvents is for network connections.

IdentityLogonEvents is for logons. The correct table for command lines is DeviceProcessEvents.

Option B is correct because DeviceNetworkEvents contains network connections that can indicate remote PowerShell sessions (port 5985/5986). Option A is incorrect because DeviceProcessEvents shows process creation, not network connections. Option C is incorrect because DeviceEvents shows general events.

Option D is incorrect because DeviceLogonEvents shows logon events, not network sessions.

Option C is correct because advanced hunting in Microsoft Defender XDR allows KQL queries to correlate process events across devices. Option A is wrong because device inventory lacks process lineage. Option B is wrong because automated investigation and response focuses on containment, not deep tracing.

Option D is wrong because threat analytics provides intelligence, not raw event data.

Option C is correct because the typo 'NtLmSsp' should be 'NtLmSsp' (note the capital L and M). The correct process name is 'NtLmSsp' (spelled with capital L and M). Option A is wrong because the time range is not specified but defaults to last 24h; this would not cause zero results.

Option B is wrong because the dynamic array syntax is correct. Option D is wrong because the summarize function works correctly.

The query looks for .scr files (screensaver, but also used to disguise executables) with names matching 8 lowercase letters on the desktop, and correlates with SMB connections to private IPs. Option A is correct because ransomware often drops executables on desktops and spreads via SMB. Option B is incorrect because the file is on the desktop, not in startup.

Option C is incorrect because no registry events are involved. Option D is incorrect because the file is .scr, not .lnk.

Options B and D are correct. SecurityEvent (Windows Event Logs) contains Event ID 4624 (logon) and 4688 (process), useful for lateral movement. DeviceNetworkEvents (Microsoft Defender for Endpoint) shows network connections.

Option A is for syslog, not Windows events. Option C is for DNS, which is less direct. Option E is for Azure activity, not lateral movement.

Option D is correct because the join condition uses Timestamp which is not precise enough; the join should use a time window, not an exact match. The where clause after join tries to use Timestamp1 (not defined) and also compares incorrectly. Option A (time range too short) is possible but less likely given 7 days.

Option B (filename list) is broad enough. Option C (RemotePort 443) is expected for HTTPS.

Option B is correct because DeviceFileEvents shows file creation and modification events, which can indicate large file copies. Option A is wrong because DeviceNetworkEvents shows network connections, not file transfers. Option C is wrong because DeviceProcessEvents shows process creation, not file transfers.

Option D is wrong because IdentityDirectoryEvents shows identity events, not file transfers.

Option B is correct because the activity log provides detailed user activities including location. Option A is wrong because App permissions is for OAuth apps. Option C is wrong because file policy is for data protection.

Option D is wrong because Cloud Discovery is for shadow IT, not user login anomalies.

Option C is correct because DeviceNetworkEvents contains network connections including RDP (destination port 3389). Summarizing by DeviceName and destination IP, then counting distinct destinations, can identify devices connecting to multiple internal IPs. Option A is incorrect because DeviceProcessEvents does not include network connections.

Option B is incorrect because IdentityLogonEvents focuses on authentication, not network connections. Option D is incorrect because Syslog is for Linux systems, not Windows RDP connections.

Microsoft Defender for Identity has a specific alert for suspected overpass-the-hash (Pass-the-Hash). Option A is for brute force. Option B is for honeytoken activity.

Option D is for privilege escalation. The correct alert is 'Suspected overpass-the-hash attack'.

Option C is correct because DeviceProcessEvents captures process creation events including command-line arguments. Option A (DeviceNetworkEvents) captures network connections but not command-line arguments. Option B (DeviceEvents) captures various events but not specifically process command lines.

Option D (DeviceImageLoadEvents) captures DLL loads, not command lines.

Advanced hunting uses tables like DeviceEvents. Option B is correct because the ScheduledTaskCreated action in DeviceEvents captures scheduled task creation. Option A is incorrect because DeviceProcessEvents records process events, not scheduled tasks.

Option C is incorrect because DeviceRegistryEvents is for registry changes. Option D is incorrect because DeviceFileEvents tracks file creation, not scheduled tasks directly.

Option A is correct because the query detects PowerShell launched from Microsoft Office applications, which is a common technique for macro-based attacks. Option B is incorrect because the query does not filter by encoded command. Option C is incorrect because it does not look for lateral movement.

Option D is incorrect because there is no external IP or network connection in the query.

C2 communications generate network traffic and DNS queries. Options A and D are correct. Option B is incorrect because Windows event logs are less direct.

Option C is incorrect because syslog may not capture all network traffic. Option E is incorrect because Azure Activity focuses on management plane.

The query calculates a baseline of daily logon counts per user over 30 days, then identifies users whose logon count in the last day exceeds 2 standard deviations above the mean. Option C is correct. Option A is incorrect because it counts logons, not failed logons.

Option B is incorrect because it compares to the user's own baseline, not peers. Option D is incorrect because it does not filter by location.

Options B and D are correct. B is correct because anomaly detection is a common hunting technique. D is correct because searching for known IOCs (indicators of compromise) is fundamental.

A is incorrect because vulnerability scanning is not a hunting technique. C is incorrect because patch management is a maintenance activity. E is incorrect because configuring mail flow is administrative.

Option C is correct because LSASS access is logged as a process access event (Event ID 4656) with specific access flags. Option A is wrong because process creation events show new processes, not access to existing ones. Option B is wrong because registry events do not capture process access.

Option D is wrong because network events are unrelated.

Option D is correct because adding a condition like Severity reduces false positives by filtering out informational alerts. Option A is wrong because adding EntityMapping doesn't change the query logic. Option B is wrong because increasing the frequency may cause more false positives.

Option C is wrong because turning off MITRE ATT&CK mapping doesn't affect false positives.

The query looks for PowerShell spawning rundll32.exe with a command line containing 'javascript:', which is a common technique to execute JavaScript via rundll32 as a form of code execution or bypass. Option A is incorrect because regsvr32.exe is not involved. Option B is for lateral movement, not shown.

Option D is for data exfiltration, not indicated.

Option A is correct because Microsoft Sentinel provides built-in connectors and analytics rules to correlate alerts across Microsoft Defender XDR, including Defender for Cloud Apps and Defender for Endpoint. Option B (Microsoft Graph API) is programmatic but not a unified hunting experience. Option C (Azure Monitor Workbooks) visualizes but does not correlate.

Option D (Power Automate) automates responses but not correlation.

Option C is correct because ServicePrincipalSignInLogs track service principal sign-ins, and auditing for successful access to Key Vault can reveal similar compromises. Option A is wrong because it's about user sign-ins. Option B is wrong because it's for user risk.

Option D is wrong because it's for managed identity, not all service principals.

Option A is correct because Isolate device disconnects the device from the network. Option B only runs a scan. Option C collects investigation package.

Option D blocks the file but doesn't isolate.

Option B is correct because advanced hunting allows you to write custom KQL queries to detect patterns like large uploads to unapproved cloud storage. Option A is wrong because custom detection rules are for creating alerts based on queries, but the question asks for hunting. Option C is wrong because incident investigation focuses on a single incident, not proactive hunting.

Option D is wrong because automation rules automate responses, not hunting.

Option A is correct because `summarize` aggregates data by specified columns, and `count()` counts rows. Option B is wrong because `project` selects columns, does not aggregate. Option C is wrong because `extend` adds new columns.

Option D is wrong because `join` merges tables.

Option A is correct because using the OfficeActivity table with summarize and bin() allows you to count download events (Operation=='FileDownloaded') per user per hour and then compare the current count to a historical average to detect anomalies. Option B is incorrect because the CommonSecurityLog table does not contain SharePoint download events. Option C is incorrect because the HuntingBookmark table is for storing bookmarks, not for running analytics.

Option D is incorrect because the SecurityAlert table contains alerts, not raw events needed for baseline calculation.

Option B is correct because the query uses `rundll32.exe` with `javascript` in the command line, which is an uncommon but known technique for executing JavaScript via rundll32. Option A is wrong because the API endpoint is correct for Log Analytics. Option C is wrong because the date range is valid.

Option D is wrong because 7-day range is valid.

Querying DeviceNetworkEvents for inbound RDP connections (port 3389) helps identify potential lateral movement. Correlating with LogonEvents for successful RDP logins confirms the movement. Option B (looking for SMB connections) is more for file sharing.

Option D (checking email forwarding) is for exfiltration. Option E (reviewing cloud app activities) is not directly RDP-related.

Azure Network Watcher flow logs provide detailed information about IP traffic through Azure networks, making them ideal for detecting anomalous outbound traffic patterns. Option A (Azure Activity Log) focuses on control plane events, not network flows. Option C (Windows Event Logs) is for host-level events, not network traffic.

Option D (Azure AD sign-in logs) is for authentication events.

Option A is correct because externaldata requires the cluster to access the URL, which may be blocked. Option B is wrong because the syntax is correct. Option C is wrong because DeviceNetworkEvents is valid.

Option D is wrong because the IPs are in the list.