SC-200 Respond to security incidents Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  DNS logs

  Why it's wrong here

  DNS logs capture name resolution queries, showing which hosts requested which names, but they lack authentication and process context. While an attacker might query for a target hostname, DNS logs alone cannot distinguish a malicious connection from legitimate traffic, nor do they reveal whether access was successful. Therefore, they are insufficient for identifying lateral movement events like share access or remote logons.

• ✓

  Microsoft Defender for Endpoint (device events)

  Why this is correct

  Microsoft Defender for Endpoint's device events provide deep host telemetry, including process creation, command lines, network connections, and local account logon events. This enables detection of lateral movement techniques such as PsExec, SMB/WMI remote execution, and RDP sessions at the endpoint level. Because it correlates specific processes with network activity and the originating host, it is a powerful source for hunting lateral movement in Sentinel.

• ✓

  Windows Event Logs (Event ID 5140)

  Why this is correct

  Windows Event Log ID 5140 specifically records network share access, including the sharing machine, target path, and account used. Attackers often use administrative shares like ADMIN$ or C$ during lateral movement, and this event can reveal the source IP address. This log provides direct evidence that a remote account accessed a share, making it a key data source for detecting lateral movement.

• ✓

  Windows Security Events (Event ID 4624)

  Why this is correct

  Windows Security Event ID 4624 is a successful logon event that captures details such as logon type, source workstation, and account name. Lateral movement often involves a compromised account logging on to multiple hosts via network or remote interactive logons, which appear as multiple 4624 events. By correlating these events across multiple systems in Sentinel, an analyst can spot an account hopping between machines, a classic sign of lateral movement.

• ✗

  Microsoft Entra ID sign-in logs

  Why it's wrong here

  Microsoft Entra ID sign-in logs record authentication to cloud applications and Azure resources, not to on-premises Windows servers. Lateral movement typically involves network protocols such as SMB, RDP, or WinRM between internal hosts, which do not generate Entra ID sign-in events. Without host-based process and logon telemetry, these logs cannot confirm that a compromised account was used to move from one machine to another.

Go deeper

Related to this question