SC-200 Certification Practice Question #238

Question

Your on-premises network contains an Active Directory Domain Services (AD DS) forest.

You have a Microsoft Entra tenant that uses Microsoft Defender for Identity. The AD DS forest syncs with the tenant.

You need to create a hunting query that will identify LDAP simple binds to the AD DS domain controllers.

Which table should you query?

Accepted Answer

The scenario syncs an on-premises AD DS forest and uses Microsoft Defender for Identity, which feeds authentication activity from the on-prem domain controllers into the `IdentityLogonEvents` advanced hunting table. MS Learn documents that this table captures domain-controller authentication and explicitly lists LogonType 8 "LDAP Cleartext (Simple authentication)" — exactly the LDAP simple-bind activity the query must surface. The official Suggested Answer, a unanimous community Most Voted, and multiple high-signal comments with runnable KQL all agree on D. The lone dissent (AADDomainServicesAccountLogon) applies to Entra Domain Services rather than the on-prem AD DS in the scenario and was directly corrected in-thread, so it is discounted.

More SC-200 practice questions