SaveMyCert
Log in
5 of 5 free questions left today·for 10 a day
SC-200 · Domain 3

Perform threat hunting practice questions

Perform threat hunting is worth 21% of the SC-200 exam — the lightest of the 3 domains. Hunting with KQL: choosing tables and writing Advanced Hunting queries, interpreting threat analytics, hunting graphs and blast radius, Sentinel Graph entity relationships, Sentinel hunting queries, KQL jobs and summary rules in the data lake, and notebooks connected to the Sentinel MCP Server. Official weighting 20–25%. 6 fully worked examples are further down this page, answers included.

Exam weight
21%
the lightest of the 3 domains
Questions
110
across 2 topics
Free, no account
5/day
a free account allows 10 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 3 domains, in Learn mode.

Review what you missed

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Perform threat hunting questions, fully explained

Questions from the SC-200 bank mapped to domain 3, with the answer key and the reasoning behind every option. None of them repeat the examples on the main SC-200 practice page.

Question 1Perform threat hunting

After a credential-phishing campaign, an analyst at Northwind must list which recipients selected the link in the message and whether Safe Links let each of them continue to the site. Which table records this?

Choose one.

  • a
    EmailUrlInfo

    This table lists the URLs found in messages; it says nothing about whether anyone selected them.

  • b
    EmailEvents

    This table records delivery and blocking at the time of delivery, not what a recipient did with a link afterwards.

  • c
    UrlClickEvents Correct

    Safe Links clicks from email, Teams and Office apps are recorded here, including whether the click was allowed or blocked.

  • d
    EmailPostDeliveryEvents

    This table records actions taken on messages after delivery, such as zero-hour auto purge, not user clicks.

The concept

Clicks on Safe Links-wrapped URLs are logged in UrlClickEvents.

Why that’s the answer

UrlClickEvents holds one row per Safe Links click, with the URL, the user, the NetworkMessageId of the message and an ActionType showing whether the click was allowed or blocked. EmailUrlInfo only says which URLs a message contained, and EmailEvents and EmailPostDeliveryEvents describe the message, not the recipient's behaviour.

How to reason it out
  1. Separate 'the message contained a link' from 'a user selected it'.
  2. Recall that Safe Links click verdicts have their own table.
  3. Query UrlClickEvents and join to EmailEvents on NetworkMessageId if you need message details.

Exam tip: Link in a message: EmailUrlInfo. Someone selected it: UrlClickEvents.

Detecting Threats with Microsoft Defender XDR for SC-200: Advanced Hunting Tables, KQL, Threat Analytics, Hunting Graphs and Sentinel Graph — the lesson that teaches this.

Question 2Perform threat hunting

Hours after a malicious message reached 40 inboxes, Microsoft Defender for Office 365 removed it. An analyst needs one row per removal that shows the action taken, what triggered it, such as zero-hour auto purge, and when it happened. Which table should the analyst query?

Choose one.

  • a
    EmailEvents

    This table describes the delivery itself; its latest delivery columns show where the message ended up, not one row per later action with its trigger.

  • b
    CloudAppEvents

    This table holds activities in Office 365 and other cloud apps from Defender for Cloud Apps, not Defender for Office 365's post-delivery record.

  • c
    MessagePostDeliveryEvents

    This table records post-delivery events for Microsoft Teams messages, not email.

  • d
    EmailPostDeliveryEvents Correct

    Actions taken on a message after it reached the mailbox are recorded here, with the action, its trigger and its time.

The concept

Post-delivery actions on email, such as ZAP, have their own table.

Why that’s the answer

EmailPostDeliveryEvents records security events that happen after Microsoft 365 delivers a message, such as a ZAP removal or a manual remediation, with the action, the action trigger, the result and the timestamp. EmailEvents is the tempting choice because its latest delivery columns reflect the final location, but it doesn't give each post-delivery action as its own event.

How to reason it out
  1. Note that the activity happened after delivery.
  2. Note that one row per action, with its trigger, is required.
  3. Choose the post-delivery table and join to EmailEvents on NetworkMessageId for sender details.

Exam tip: Delivered, then removed? The removal is in EmailPostDeliveryEvents.

Detecting Threats with Microsoft Defender XDR for SC-200: Advanced Hunting Tables, KQL, Threat Analytics, Hunting Graphs and Sentinel Graph — the lesson that teaches this.

Question 3Perform threat hunting

Microsoft Defender for Identity sensors run on all of Tailspin's domain controllers. A threat hunter wants to see which workstations sent SAMR or LDAP requests that listed the members of the Domain Admins group this week. Which table holds these events?

Choose one.

  • a
    IdentityDirectoryEvents

    This table records changes and system events on the domain controller, such as membership changes, not read requests.

  • b
    IdentityLogonEvents

    This table records authentication events against Active Directory and online services, not directory queries.

  • c
    DeviceNetworkEvents

    This table shows a device's network connections, so it could show traffic to the domain controller but not which object was queried.

  • d
    IdentityQueryEvents Correct

    Queries for Active Directory objects, including LDAP and SAMR reconnaissance, are recorded here with the queried object.

The concept

Defender for Identity splits its data into logons, directory changes and directory queries.

Why that’s the answer

IdentityQueryEvents holds queries for Active Directory objects such as users, groups, devices and domains, so LDAP and SAMR enumeration of a group shows up there with the source device and the target object. IdentityDirectoryEvents is the near-twin, but it records changes such as a group membership update, not someone reading the group.

How to reason it out
  1. Classify the activity: reading directory data, not changing it or signing in.
  2. Map directory reads to the query table.
  3. Filter for the Domain Admins object and the SAMR or LDAP query types.

Exam tip: Read the directory: IdentityQueryEvents. Change the directory: IdentityDirectoryEvents.

Detecting Threats with Microsoft Defender XDR for SC-200: Advanced Hunting Tables, KQL, Threat Analytics, Hunting Graphs and Sentinel Graph — the lesson that teaches this.

Question 4Perform threat hunting

An analyst at Woodgrove learns that a service account was added to the on-premises Enterprise Admins group overnight. Defender for Identity covers every domain controller. Which table should the analyst query to find who made the change and when?

Choose one.

  • a
    IdentityDirectoryEvents Correct

    Changes on a domain controller, such as group membership changes, are recorded here with the actor and the time.

  • b
    IdentityQueryEvents

    This table records queries that read directory objects; adding a member is a change, not a query.

  • c
    IdentityInfo

    This table holds account details from sources such as Microsoft Entra ID, not a record of who changed a group and when.

  • d
    EntraIdSpnSignInEvents

    This table holds Microsoft Entra service principal and managed identity sign-ins; an on-premises group change isn't a cloud sign-in.

The concept

Directory changes on domain controllers are hunted in IdentityDirectoryEvents.

Why that’s the answer

IdentityDirectoryEvents covers identity-related and system events on an on-premises domain controller running Active Directory, including group membership changes with the account that made them. IdentityQueryEvents only shows reads, IdentityInfo describes accounts rather than events, and the Entra sign-in table is about cloud authentication.

How to reason it out
  1. Recognise the event as a change to an on-premises directory object.
  2. Pick the Defender for Identity table for directory changes.
  3. Filter on the group membership change action type and the group name.

Exam tip: Who changed an AD group? IdentityDirectoryEvents.

Detecting Threats with Microsoft Defender XDR for SC-200: Advanced Hunting Tables, KQL, Threat Analytics, Hunting Graphs and Sentinel Graph — the lesson that teaches this.

Question 5Perform threat hunting

A malicious PDF attachment reached several mailboxes at Litware. A hunter wants one result set that lists every message carrying the file, joined to each device where the same file was later written to disk. Which TWO tables should the query join? (Select TWO.)

Choose TWO.

  • a
    EmailUrlInfo

    This table lists URLs in messages; the threat here is an attached file, not a link.

  • b
    EmailAttachmentInfo Correct

    This table lists the files attached to messages, with each file's SHA256 and the message's NetworkMessageId.

  • c
    DeviceImageLoadEvents

    This table records DLLs loaded into processes; a PDF saved to disk isn't an image load.

  • d
    DeviceFileEvents Correct

    This table records files created or modified on devices, with the SHA256 that matches the attachment.

  • e
    EmailEvents

    This table describes each message and its delivery, but it doesn't carry the attachment's file hash to join on.

The concept

Email and endpoint data join on the file hash.

Why that’s the answer

EmailAttachmentInfo gives the attachment's SHA256 for each NetworkMessageId, and DeviceFileEvents gives the SHA256 of files written on devices, so joining the two on SHA256 links every message to every device that saved the file. EmailEvents is the tempting choice for 'every message', but it has no file hash; you can still join it to EmailAttachmentInfo on NetworkMessageId for sender details.

How to reason it out
  1. Identify the shared key across email and endpoint data: the file hash.
  2. Pick the email table that carries attachment hashes.
  3. Pick the endpoint table that records files written to disk, then join on SHA256.

Exam tip: Attachment to device: EmailAttachmentInfo joined to DeviceFileEvents on SHA256.

Detecting Threats with Microsoft Defender XDR for SC-200: Advanced Hunting Tables, KQL, Threat Analytics, Hunting Graphs and Sentinel Graph — the lesson that teaches this.

Question 6Perform threat hunting

A hunting query scans 30 days of DeviceProcessEvents with ProcessCommandLine contains "mimikatz" and uses a large share of the tenant's CPU quota. The team wants to match mimikatz as a whole term, still regardless of case, at lower cost. Which filter should replace it?

Choose one.

  • a
    | where ProcessCommandLine contains_cs "mimikatz"

    contains_cs is faster than contains, but it is case-sensitive, which breaks the requirement.

  • b
    | where ProcessCommandLine has "mimikatz" Correct

    has matches whole indexed terms instead of scanning for substrings, and it stays case-insensitive.

  • c
    | where ProcessCommandLine matches regex "mimikatz"

    Regular expressions cost more than term matching; Microsoft advises keeping them for complex patterns.

  • d
    | where ProcessCommandLine startswith "mimikatz"

    This matches only command lines that begin with the word, so a command line that starts with a path or another tool is missed.

The concept

has beats contains for whole-term matches.

Why that’s the answer

contains looks for the string inside every word, so it can't use the term index and is expensive. has matches whole terms against the index, so it is cheaper and still case-insensitive. contains_cs and has_cs are faster again, but they're case-sensitive, so they break the stated requirement here.

How to reason it out
  1. Note both requirements: whole-term match and case-insensitive.
  2. Rule out case-sensitive operators.
  3. Choose the indexed term operator has.

Exam tip: Whole word, any case, cheaper: has, not contains.

Detecting Threats with Microsoft Defender XDR for SC-200: Advanced Hunting Tables, KQL, Threat Analytics, Hunting Graphs and Sentinel Graph — the lesson that teaches this.

What SC-200 domain 3 tests, topic by topic

The official exam guide breaks Perform threat hunting into 2 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published SC-200 practice questions per topic in Perform threat hunting
TopicWhat it coversQuestions
Detect threats by using Microsoft Defender XDRSkills outline section (SC-200, skills measured as of October 21, 2026): Identify the appropriate table to use in a KQL query; Identify threats by using Kusto Query Language (KQL); Create Advanced Hunting queries; Interpret threat analytics in Microsoft Defender XDR; Create hunting graphs, including blast radius; Analyze relationships between entities by using Sentinel Graph.55
Detect threats by using the Microsoft Sentinel platformSkills outline section (SC-200, skills measured as of October 21, 2026): Create and monitor hunting queries; Create and manage KQL jobs in Data lake; Create and manage Summary rule tables for querying; Hunt for threats by using Notebooks, including connection to the Sentinel MCP Server.55
Total110

Revise Perform threat hunting before you drill it

Detecting Threats with Microsoft Defender XDR for SC-200: Advanced Hunting Tables, KQL, Threat Analytics, Hunting Graphs and Sentinel GraphQuestions on this topic are short SOC scenarios in Microsoft Defender XDR where the analyst must pick an advanced hunting table, a KQL filter, aggregation or join, a set of result columns, a threat analytics section or a graph tool that meets a stated requirement. Many show a short KQL query to complete or fix, and the options are usually valid KQL that differ in one detail: case sensitivity, term versus substring matching, join flavor, count versus distinct count, or which process columns describe the parent. Expect near-twin tables (IdentityQueryEvents versus IdentityDirectoryEvents, DeviceLogonEvents versus IdentityLogonEvents, EmailEvents versus EmailPostDeliveryEvents), documented limits (the 30-day window, result size, CPU cycles, FileProfile record counts, UTC), and Select TWO items about Take actions columns, threat analytics permissions and hunting graph prerequisites. Graph items hinge on the starting point and inputs of each predefined scenario and on how long each kind of custom graph lasts.Detecting Threats on the Microsoft Sentinel Platform for SC-200: Hunting Queries, Bookmarks, Hunts, KQL Jobs, Summary Rules, Notebooks and the MCP ServerQuestions on this topic are short SOC scenarios in Microsoft Sentinel where the analyst must pick the Hunting page action, column or tab, the data lake tool (KQL job, summary rule, notebook job) or the MCP collection and role that meets a stated requirement. Options are usually close alternatives that are all real features, so the deciding detail is a limit, a tier, a time range or a permission. Many stems hinge on a constraint such as minimizing ingestion cost, least privilege, least administrative effort, writing each event exactly once or not ingesting a source, and troubleshooting items describe a failure whose cause you must identify. Some items are Select TWO, and a few show a short KQL or Python snippet to fix.

Other SC-200 domains

Domain 1: Manage a security operations environment42% of the exam · 217 questionsDomain 2: Respond to security incidents37% of the exam · 192 questionsAll SC-200 practice questionsMixed sessions across all 3 domains — the way the real exam interleaves them.

Perform threat hunting: your questions

Perform threat hunting is domain 3 of the SC-200 exam guide and carries 21% of the scored content — the lightest of the 3 domains. On a 50-question paper that works out to roughly 11 questions, though Microsoft Azure does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official SC-200 exam guide.