SC-200 Perform threat hunting Practice Question
Exhibit
Refer to the exhibit.
```json
{
"id": "12345678-1234-1234-1234-123456789abc",
"displayName": "Hunt for C2",
"description": "Look for beaconing patterns",
"queryText": "DeviceNetworkEvents | where Timestamp > ago(1d) | summarize count() by RemoteIP, DeviceName | where count_ > 100",
"tactics": ["CommandAndControl"],
"techniques": ["T1071"]
}
```You are reviewing a custom hunting query in Microsoft Sentinel. The query above returns results, but you suspect it misses low-frequency beaconing. Which modification improves detection while reducing false positives?
⚠ Common exam trap
SC-200 often tests the misconception that lowering a count threshold improves beaconing detection — candidates confuse 'more sensitive' with 'more accurate' and ignore that beaconing is defined by timing regularity, not volume.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a sliding window to count distinct connection times per IP per device
Low-frequency beaconing is characterized by a small number of connections spread over long, regular intervals — a simple count threshold misses it because the total count is low. Using a sliding window (e.g., bin() or make-series with a time window) to count distinct connection times per remote IP per device surfaces the periodicity and regularity that distinguishes beaconing from normal traffic, while grouping by both IP and device reduces false positives from benign recurring connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a sliding window to count distinct connection times per IP per device
Why this is correct
Grouping connections into a sliding window and counting distinct connection times per IP and device surfaces periodic low-and-slow beaconing that single-event thresholds miss, while the distinct-count aggregation suppresses noisy repeated hits from the same host, cutting false positives.
- ✗
Group by DeviceName only
Why it's wrong here
Grouping by DeviceName alone collapses all remote endpoints per host, so beaconing to a single destination is diluted and false positives rise. It tempts because per-host summarisation reduces result volume, so grouping by device is the right choice when hunting for host-level anomalies rather than per-destination beaconing patterns.
- ✗
Decrease the count threshold to 10
Why it's wrong here
Lowering the count threshold admits more low-count events, increasing false positives rather than reducing them. It tempts because missed low-frequency beaconing suggests the threshold is too high, so decreasing it is the right choice when the query is genuinely under-sensitive and the environment has little benign periodic traffic.
- ✗
Add RemotePort to the summarize clause
Why it's wrong here
Adding RemotePort to the summarize clause splits each destination into many short-lived port buckets, fragmenting beacon counts and defeating the periodicity detection. It tempts because port detail aids investigation, so including RemotePort is the right choice when the query must distinguish services on a single beaconing host.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.