EarnYourCert
Open the app
Exams › SC-200 › Domain 3 of 3
SC-200 · Domain 3 of 3 · 20-25% of the exam

Perform threat hunting

Domain 3 of SC-200 accounts for 20-25% of the exam. EarnYourCert has 93 original questions for this domain, all with explanations: 62 multiple choice, 12 yes/no and 19 completion or ordering items, like the real exam.

Practice domain 3 for free →No sign-up. Choose how many questions you want.

Domain 3 sample questions

8 questions from our 93-question bank for this domain. Try to answer before revealing the solution.

1. Which advanced hunting table contains process creation events from devices onboarded to Defender for Endpoint?

  1. DeviceProcessEvents
  2. EmailEvents
  3. CloudAppEvents
  4. IdentityLogonEvents
Show answer

Correct answer: A. DeviceProcessEvents records process creations and related command lines.

2. Which table should you query to find emails delivered to users with their sender, subject and threat detection details?

  1. DeviceRegistryEvents
  2. DeviceNetworkEvents
  3. EmailEvents
  4. IdentityDirectoryEvents
Show answer

Correct answer: C. EmailEvents holds email delivery information from Defender for Office 365.

3. What does threat analytics in Microsoft Defender XDR provide?

  1. A report of licensed users per workload with renewal dates and costs
  2. A summary of monthly cloud spend broken down by subscription and service
  3. A schedule of device backups
  4. Reports on emerging threats with exposure and recommended mitigations
Show answer

Correct answer: D. Threat analytics helps prioritize and mitigate current threats.

4. Which table contains activity from Defender for Cloud Apps connected apps, such as SaaS file downloads?

  1. CloudAppEvents
  2. SecurityEvent
  3. EmailEvents
  4. DeviceEvents
Show answer

Correct answer: A. CloudAppEvents records cloud application activities.

5. What does the KQL let statement do?

  1. Sends the query results by email
  2. Deletes the matching rows
  3. Defines a variable or reusable expression
  4. Creates a saved function in the workspace for all users
Show answer

Correct answer: C. let simplifies and reuses values such as a time range.

6. What does the Microsoft Sentinel MCP server enable?

  1. Replication of Sentinel data to another Azure region
  2. AI assistants and agents can securely query Sentinel data
  3. Automatic Windows updates for the monitored servers
  4. DNS resolution for names inside the workspace
Show answer

Correct answer: B. MCP is a protocol that connects AI tools to data sources.

7. Which Sentinel table stores alerts generated by Sentinel and connected products?

  1. Heartbeat
  2. OfficeActivity
  3. SecurityAlert
  4. Perf
Show answer

Correct answer: C. SecurityIncident stores incidents; SecurityAlert stores alerts.

8. Which KQL operator splits a dynamic array column into one row per element?

  1. top
  2. mv-expand
  3. distinct
  4. summarize
Show answer

Correct answer: B. mv-expand expands multivalue arrays or property bags into separate rows.

Practice domain 3 for free →

Other SC-200 domains

1Manage a security operations environment40-45% 2Respond to security incidents35-40% SC-200: full practice exam→