SC-200 Perform threat hunting Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  SecurityEvent

  Why this is correct

  SecurityEvent is a core Windows event log source in Sentinel, capturing event IDs such as 4624 (successful logon), 4625 (failed logon), 4672 (special privileges), and 4720 (user account created). Because it includes logon types and account logon details, it directly supports detection of brute-force attacks, pass-the-hash, and lateral movement across managed endpoints. Without this table, identity-focused hunts would lack the fine-grained audit trails of OS-level authentication and authorization.

• ✓

  SigninLogs

  Why this is correct

  SigninLogs contains both interactive and non-interactive sign-in events generated by Azure AD, including information like the user principle name, IP address, device, conditional access policies applied, and sign-in error codes. This data is essential for detecting identity compromise scenarios such as impossible travel, token replay, or repeated failed authentication attempts against cloud applications. It complements on-premises SecurityEvent data by providing a cloud-side view of how and when users authenticate.

• ✗

  CommonSecurityLog

  Why it's wrong here

  CommonSecurityLog is the aggregated table for data ingested from network appliances such as firewalls, IDS/IPS, and VPN gateways, typically formatted via the Common Event Format (CEF). While it may occasionally include VPN authentication success or failure entries, its primary purpose is to model network traffic and suspicious flows, not to maintain a comprehensive directory of user identity events. Relying on it for identity monitoring would miss crucial cloud and directory-level telemetry.

• ✓

  AuditLogs

  Why this is correct

  AuditLogs in Sentinel come from Azure Active Directory activity logs and track every change to directory objects, including user creation, password resets, group membership modifications, role assignments, and consent to applications. This makes it invaluable for detecting anomalous administrative actions such as a newly created global admin or an unexpected alteration to a mailbox's permissions. AuditLogs provide the 'who did what' record for cloud directory changes, enabling investigations of privilege escalation and persistence techniques.

• ✗

  OfficeActivity

  Why it's wrong here

  OfficeActivity represents the unified audit log for Microsoft 365 services such as Exchange Online, SharePoint, and Teams, capturing user interactions like email access, document downloads, and chat activity. While these events help detect compromised Microsoft 365 accounts behaving abnormally, they are not the primary source for identity authentication events or directory configuration changes. In a focused identity investigation, OfficeActivity offers secondary context but lacks the core sign-in and directory audit telemetry found in SignInLogs and AuditLogs.

Go deeper

Related to this question