SC-200 Perform threat hunting Practice Question
Your team uses Microsoft Defender for Endpoint to hunt for signs of credential theft. You want to query for events where a process accesses the LSASS process memory. Which event type should you look for?
⚠ Common exam trap
The trap is confusing process access (4656) with process creation (4688) — candidates often pick 4688 because they think 'process' is the key word, but the question asks about memory access, which is a handle/object access event.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Process access (Event 4656)
Credential theft via LSASS memory access is captured by Windows Security Event ID 4656 (and its companion 4663), which logs handle requests to objects including processes. Defender for Endpoint surfaces this as 'Process access' events, making it the correct event type to query for LSASS access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Process access (Event 4656)
Why this is correct
Process access events, recorded as Event 4656, capture when one process opens a handle to another with specific access rights. LSASS credential dumping appears here because tools request read access to lsass.exe memory, matching the hunting requirement.
- ✗
Network connection (Event 5156)
Why it's wrong here
Event 5156 logs permitted network connections, capturing IP addresses and ports rather than memory access to LSASS. It is tempting because credential theft often involves remote traffic, but detecting LSASS reads requires the process-access event, not connection logging.
- ✗
Registry modification (Event 4657)
Why it's wrong here
Event 4657 records registry value modifications, which never captures a process opening the LSASS process memory. It is tempting because attackers do modify registry keys for persistence, but LSASS credential dumping is detected through process-access auditing, not registry auditing.
- ✗
Process creation (Event 4688)
Why it's wrong here
Event 4688 records process creation, showing the executable and command line but not the memory-access operation against LSASS. It is tempting because credential-dumping tools are launched as new processes, yet the actual LSASS read requires the process-access event.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.