SC-200 Perform threat hunting Practice Question
Exhibit
{
"QueryText": "DeviceNetworkEvents | where RemotePort == 53 and Timestamp > ago(1d) | summarize count() by DeviceName, RemoteIP | where count_ > 1000",
"QueryDescription": "Hunt for potential DNS amplification attacks from internal devices"
}Refer to the exhibit. You are using a hunting query in Microsoft Defender XDR to find devices generating excessive DNS queries. The query returns many results, but you want to exclude legitimate DNS servers. What is the best approach to refine the query?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a `where` clause to exclude known internal DNS server IPs.
Correct answer: A. Adding a `where` clause to exclude known internal DNS server IPs reduces false positives by filtering out legitimate DNS traffic from your own DNS servers, which generate high DNS query volumes by design. Options B, C, and D are incorrect: B – Changing the RemotePort filter to UDP 53 only is already implied in a DNS query hunt and does not exclude internal servers; C – Joining with DeviceInfo may not effectively filter out DNS servers and could add complexity; D – Increasing the threshold risks missing true excessive queries that are still below the new threshold but above normal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a `where` clause to exclude known internal DNS server IPs.
Why this is correct
Excluding known DNS servers reduces noise from legitimate traffic.
- ✗
Join with DeviceInfo to filter by device type.
Why it's wrong here
Device type may not help; DNS servers could be on any device.
- ✗
Change the RemotePort filter to UDP 53 only instead of all DNS.
Why it's wrong here
DNS uses UDP 53 typically; adding TCP 53 would catch more, not less.
- ✗
Increase the count threshold to 5000.
Why it's wrong here
Adjusting threshold may miss low-volume attacks.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.