SC-200 Threat Hunting & Sentinel Analytics Rules

1. Which KQL function calculates the count of unique values in a column?

Count()

Dcount()

Sum()

Avg()

Submit

3. In threat hunting, what does 'baselining' refer to?

Establishing normal behavior patterns for comparison

Creating backup copies of data

Blocking suspicious IP addresses

Resetting user passwords

4. True or False: The CommonSecurityLog table is used for multi-vendor firewall and proxy logs.

True

False

5. What is the primary advantage of using playbooks in Sentinel?

Automates incident response workflows

Increases storage capacity

Encrypts all data

Blocks all users

Submit

7. In Sentinel analytics rules, what triggers an alert?

A scheduled query matching defined conditions

Manual user intervention

Network packet loss

System boot-up

8. Which operator groups rows and calculates aggregate functions per group?

Where

Extend

Summarize

Sort

9. What does MITRE ATT&CK help with in threat hunting?

Classifying adversary tactics and techniques

Encrypting network traffic

Deploying firewalls

Managing user passwords

10. True or False: Hunting queries in Sentinel automatically create alerts without manual review.

True

False

11. What is the primary purpose of threat hunting in Microsoft Sentinel?

Proactively search for undetected threats and adversary behavior

Automatically block all suspicious network traffic

Replace traditional firewall rules

Monitor only incoming external traffic

12. In Sentinel, what is an 'incident'?

A collection of related alerts grouped by correlation rules

A single security event log entry

A user access attempt

A network connection timeout

13. What is the purpose of the 'join' operator in threat hunting queries?

Combines data from two tables based on matching columns

Removes duplicate records

Sorts results alphabetically

Filters out null values

14. Which Sentinel feature allows correlation of events from multiple data sources?

Playbooks

Fusion engine

Workbooks

Hunting queries

15. True or False: Scheduled query rules execute at regular intervals to detect threats.

True

False

16. What is the function of the 'extend' operator in KQL?

Removes columns from results

Creates new calculated columns

Groups data by specific fields

Joins two tables together

17. Which table in Sentinel contains Windows Security events?

SecurityEvent

CommonSecurityLog

OfficeActivity

SigninLogs

18. In Sentinel analytics rules, what is a 'detection rule'?

A KQL query that identifies suspicious activity patterns

A network firewall policy

An automated incident response workflow

A user access control policy

19. What does the 'summarize' operator do in KQL queries?

Selects specific columns from results

Combines rows with matching values into aggregate results

Filters data based on conditions

Sorts results in ascending order

20. Which Kusto Query Language (KQL) operator is used to filter rows based on a condition?

Project

Where

Summarize

Join

SC-200 Threat Hunting with Sentinel Analytics Rules Quiz

1. Which KQL function calculates the count of unique values in a column?

2.

What first name or nickname would you like us to use?

2. The 'let' statement in KQL is used to ______ variables for reuse in queries.

3. In threat hunting, what does 'baselining' refer to?

4. True or False: The CommonSecurityLog table is used for multi-vendor firewall and proxy logs.

5. What is the primary advantage of using playbooks in Sentinel?

6. The KQL 'render' operator is used to ______ query results.

7. In Sentinel analytics rules, what triggers an alert?

8. Which operator groups rows and calculates aggregate functions per group?

9. What does MITRE ATT&CK help with in threat hunting?

10. True or False: Hunting queries in Sentinel automatically create alerts without manual review.

11. What is the primary purpose of threat hunting in Microsoft Sentinel?

12. In Sentinel, what is an 'incident'?

13. What is the purpose of the 'join' operator in threat hunting queries?

14. Which Sentinel feature allows correlation of events from multiple data sources?

15. True or False: Scheduled query rules execute at regular intervals to detect threats.

16. What is the function of the 'extend' operator in KQL?

17. Which table in Sentinel contains Windows Security events?

18. In Sentinel analytics rules, what is a 'detection rule'?

19. What does the 'summarize' operator do in KQL queries?

20. Which Kusto Query Language (KQL) operator is used to filter rows based on a condition?