SC-200 Perform threat hunting Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Search for access to applications the user does not normally use

  Why this is correct

  Checking for access to applications outside a user's historical usage is a high-fidelity indicator of identity compromise because attackers rarely mimic the exact application footprint of the legitimate user. In Microsoft Sentinel, you can use UEBA data or sign-in logs to build a baseline and then alert when a newly logged-on application has no prior events for that user. This type of anomaly is less likely to be a false positive than raw volume-based signals, because it directly reflects the attacker's post-authentication intent.

• ✗

  Query DNS logs for unusual domain resolutions

  Why it's wrong here

  DNS query logs are primarily used to detect command-and-control traffic, domain generation algorithms, or DNS tunneling, not to identify a compromised user identity. Unusual domain resolutions can indicate malware on an endpoint, but they do not tell you which account's credentials were stolen or whether authentication was an attack. For an identity-focused investigation, you would instead correlate authentication events, MFA claims, and session context.

• ✓

  Look for multiple failed logon attempts followed by a successful one

  Why this is correct

  A sequence of multiple failed logon events immediately followed by a successful authentication strongly indicates a brute-force or password-spraying attack, especially when the same account is targeted from different source IPs or over a short time window. The successful logon is the moment the attacker obtains access, so you should treat it as the start of the incident for hunting actions. Correlating Windows Event IDs 4625 and 4624, or Azure AD Sign-in logs, lets you confirm that the success came from an unfamiliar or malicious IP.

• ✗

  Investigate changes to firewall rules

  Why it's wrong here

  Firewall rule changes are a network infrastructure control and are not directly tied to a user's identity compromise, so they rarely appear in an investigation focused on authentication anomalies. While an attacker with admin-level privileges might alter firewall rules for lateral movement, the initial account breach would not be detectable through those changes. In an identity incident, you should prioritize logs that capture who authenticated, when, from where, and to what resource, rather than network allow/deny modifications.

• ✓

  Review UEBA anomalies for unusual logon times or locations

  Why this is correct

  UEBA analytics model a user's normal logon times, geographic locations, and peer group behavior, so deviations such as a 3 a.m. sign-in from a newly observed country are strong signals of session token theft or account takeover. These contextual anomalies complement other indicators because they detect anomalous access patterns even when no malware or failed logon events occur. Sentinel's UEBA dashboard and Microsoft Defender for Identity alerts operationalize these signals to reduce dwell time during an investigation.

Go deeper

Related to this question