SC-200 Perform threat hunting Practice Question
Which THREE actions should a threat hunter take when using Microsoft Defender XDR advanced hunting to investigate a potential ransomware outbreak? (Select THREE.)
⚠ Common exam trap
SC-200 often tests the specific artifacts relevant to ransomware versus other attack types; candidates may select email-related actions due to the initial access vector, but the question asks about investigating the outbreak itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check for service installation events that mimic system services.
Option A is correct because ransomware operators frequently install malicious services with names that mimic legitimate system services (for example, svchost-like or Windows Update-like names) to achieve persistence and evade detection, so hunting service installation events in DeviceEvents (ActionType == 'ServiceInstalled') surfaces this masquerading behavior. Option C is correct because scheduled tasks are a common ransomware persistence mechanism; hunting TaskScheduler events such as TaskCreated/TaskUpdated in DeviceEvents reveals malicious tasks that re-launch the encryptor or payload after reboot. Option D is correct because correlating ProcessCreate events with FileModified/FileCreated events (for example, a process spawning and then rapidly modifying or renaming many files with extensions like .locked) exposes the encryption behavior that is the hallmark of a ransomware outbreak. Option B does not belong because mailbox audit logs and email forwarding rules are relevant to business email compromise or phishing investigations, not to endpoint ransomware encryption activity in advanced hunting. Option E does not belong because password change events for service accounts relate to credential abuse or account takeover detection, which is not the primary evidence of an active ransomware outbreak on endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check for service installation events that mimic system services.
Why this is correct
Ransomware actors frequently register malicious binaries as Windows services to survive reboots and gain SYSTEM-level execution. Querying service installation events in advanced hunting exposes this persistence technique, satisfying the hunt's requirement to uncover stealthy ransomware footholds beyond initial encryption activity.
- ✗
Review mailbox audit logs for email forwarding rules.
Why it's wrong here
Mailbox forwarding rules point to business email compromise or exfiltration, not ransomware encryption behaviour such as file modifications and shadow copy deletion. It is tempting because forwarding rules are a common persistence mechanism, and in a BEC investigation reviewing mailbox audit logs would be the correct action.
- ✓
Inspect scheduled tasks for persistence mechanisms.
Why this is correct
Ransomware operators commonly create scheduled tasks to relaunch payloads after remediation or at set intervals. Hunting task-creation events in advanced hunting reveals this persistence mechanism, directly addressing the scenario's need to identify how the outbreak sustains itself across reboots and user sessions.
- ✓
Correlate process creation events with file modification events.
Why this is correct
Joining process creation events with file modification events exposes the causal chain of a ransomware binary spawning and then encrypting or renaming files. This correlation satisfies the hunt's requirement to distinguish genuine encryption activity from benign file writes within Microsoft Defender XDR advanced hunting.
- ✗
Review password change events for service accounts.
Why it's wrong here
Service account password changes are routine and rarely indicate ransomware, which spreads via execution, encryption, and credential theft on user endpoints. It is tempting because compromised service accounts enable persistence, and in an identity-focused investigation of privilege escalation reviewing those events would be warranted.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.