A security analyst wants to use KQL to count the number of failed logon attempts on each device. Which KQL query correctly counts logon events where LogonType is not successful?

DeviceLogonEvents | where ActionType == "LogonFailed" | summarize Count = count() by DeviceName

DeviceLogonEvents | where LogonType == "Failed" | summarize Count = count() by DeviceName

DeviceLogonEvents | where ActionType == "LogonSuccess" | summarize Count = count() by DeviceName

DeviceLogonEvents | summarize Count = count() by DeviceName | where ActionType == "LogonFailed"

During an incident investigation, a security analyst identifies a compromised user account that has accessed multiple mailboxes and SharePoint sites. The analyst wants to visualize the potential impact of this compromise. Which feature in Microsoft Defender XDR should the analyst use?

Review the incident timeline in Microsoft Defender XDR.

Open the threat analytics report for the user account to see the impact.

Use the advanced hunting query to list all the accessed resources in a table.

Create a hunting graph to show the relationships between the user account and the accessed resources.

A security analyst is proactively hunting for signs of a new malware family that uses a specific command-line argument. The analyst wants to find all processes that were started with this argument. Which advanced hunting query would be most appropriate?

DeviceNetworkEvents | where RemoteUrl contains '--malicious-arg' | project Timestamp, DeviceName, RemoteUrl

DeviceProcessEvents | where ProcessCommandLine contains '--malicious-arg' | project Timestamp, DeviceName, FileName, ProcessCommandLine

DeviceFileEvents | where FileName contains '--malicious-arg' | project Timestamp, DeviceName, FileName

CloudAppEvents | where ActionType contains '--malicious-arg' | project Timestamp, AccountUpn, ActionType

Microsoft Certified:Security Operations Analyst Associate

Domain 3Objective 1

Detect Threats by Using Microsoft Defender XDR SC-200 Practice Questions (Page 3)

Part of the Perform threat hunting domain, which accounts for 20–25% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 4–8 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

20–25%of the exam

Questions 11–15

11foundation · easy
A security analyst wants to write a KQL query in Microsoft Defender XDR advanced hunting to find processes that were created on a specific device. Which table should the analyst query?
Select an answer first
12foundation · easy
A security analyst wants to use KQL to count the number of failed logon attempts on each device. Which KQL query correctly counts logon events where LogonType is not successful?
Select an answer first
13application · medium
During an incident investigation, a security analyst identifies a compromised user account that has accessed multiple mailboxes and SharePoint sites. The analyst wants to visualize the potential impact of this compromise. Which feature in Microsoft Defender XDR should the analyst use?
Select an answer first
14application · easy
A security analyst at Northwind is hunting for a possible malware infection that creates a specific file in the Windows temp directory. The analyst wants to find all devices where this file was created in the last 48 hours. Which table should the analyst query in Microsoft Defender XDR advanced hunting?
Select an answer first
15application · medium
A security analyst is proactively hunting for signs of a new malware family that uses a specific command-line argument. The analyst wants to find all processes that were started with this argument. Which advanced hunting query would be most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Detect Threats by Using Microsoft Defender XDR SC-200 Practice Questions (Page 3)

Questions 11–15

A security analyst wants to write a KQL query in Microsoft Defender XDR advanced hunting to find processes that were created on a specific device. Which table should the analyst query?

A security analyst wants to use KQL to count the number of failed logon attempts on each device. Which KQL query correctly counts logon events where LogonType is not successful?

During an incident investigation, a security analyst identifies a compromised user account that has accessed multiple mailboxes and SharePoint sites. The analyst wants to visualize the potential impact of this compromise. Which feature in Microsoft Defender XDR should the analyst use?

A security analyst is proactively hunting for signs of a new malware family that uses a specific command-line argument. The analyst wants to find all processes that were started with this argument. Which advanced hunting query would be most appropriate?

Keep studying — Perform threat hunting