A threat intelligence report describes a new campaign that uses a specific PowerShell script to download a payload from a known malicious domain. The SOC team wants to proactively hunt for this activity in their environment. Which approach would be most effective?

Search the raw logs in Microsoft Sentinel for any references to the malicious domain.

Use the threat analytics dashboard to review the report and then create an advanced hunting query based on the recommended hunting queries provided.

Create a custom advanced hunting query from scratch that searches for PowerShell execution and network connections to the malicious domain.

Wait for the threat to appear in the environment and then investigate the alert.

A security analyst is investigating a potential data breach. The analyst suspects that a user exfiltrated data by sending it via email. Which KQL query would be most effective in identifying this activity?

EmailEvents | where SenderFromAddress == 'user@contoso.com' | project Timestamp, Subject, AttachmentName, RecipientEmailAddress

DeviceFileEvents | where AccountName == 'user' | project Timestamp, FileName, FolderPath

CloudAppEvents | where AccountObjectId == 'user@contoso.com' | project Timestamp, ActionType, FileName

IdentityLogonEvents | where AccountUpn == 'user@contoso.com' | project Timestamp, AccountUpn, IPAddress

A security analyst is proactively hunting for signs of a new malware campaign that uses a specific PowerShell script to download a payload from a known malicious domain. The analyst wants to find all instances of this activity in the environment. The analyst also wants to identify any devices that may be affected. Which approach would be most effective?

Use the threat analytics report to get the recommended hunting queries, then run them to find affected devices.

Search the raw logs in Microsoft Sentinel for any references to the malicious domain.

Create a custom advanced hunting query that searches for PowerShell execution and network connections to the malicious domain.

Wait for the threat to appear in the environment and then investigate the alert.

A security analyst wants to use KQL to find all devices that have a specific file named 'malware.exe' on them. Which KQL query correctly searches the DeviceFileEvents table for this file?

DeviceProcessEvents | where FileName == "malware.exe"

DeviceFileEvents | where DeviceName == "malware.exe"

DeviceFileEvents | where FilePath contains "malware.exe"

DeviceFileEvents | where FileName == "malware.exe"

A security analyst wants to create an advanced hunting query to find all devices that have both a suspicious process and a network connection to a known malicious IP address. Which KQL approach is most appropriate?

Query DeviceProcessEvents only and filter on the malicious IP

Query DeviceNetworkEvents only and filter on the process name

Join the DeviceProcessEvents and DeviceNetworkEvents tables on DeviceId

Use the union operator to combine both tables

Microsoft Certified:Security Operations Analyst Associate

Domain 3Objective 1

Detect Threats by Using Microsoft Defender XDR SC-200 Practice Questions (Page 2)

Part of the Perform threat hunting domain, which accounts for 20–25% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 4–8 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

20–25%of the exam

Questions 6–10

6application · medium
A threat intelligence report describes a new campaign that uses a specific PowerShell script to download a payload from a known malicious domain. The SOC team wants to proactively hunt for this activity in their environment. Which approach would be most effective?
Select an answer first
7application · medium
A security analyst is investigating a potential data breach. The analyst suspects that a user exfiltrated data by sending it via email. Which KQL query would be most effective in identifying this activity?
Select an answer first
8expert · hard
A security analyst is proactively hunting for signs of a new malware campaign that uses a specific PowerShell script to download a payload from a known malicious domain. The analyst wants to find all instances of this activity in the environment. The analyst also wants to identify any devices that may be affected. Which approach would be most effective?
Select an answer first
9foundation · easy
A security analyst wants to use KQL to find all devices that have a specific file named 'malware.exe' on them. Which KQL query correctly searches the DeviceFileEvents table for this file?
Select an answer first
10foundation · easy
A security analyst wants to create an advanced hunting query to find all devices that have both a suspicious process and a network connection to a known malicious IP address. Which KQL approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.