20+ practice questions focused on Perform threat hunting — one of the most tested topics on the Microsoft Security Operations Analyst SC-200 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Perform threat hunting PracticeA security analyst is using KQL in Microsoft Sentinel to hunt for potential data exfiltration by a user who has been sending unusually large amounts of data to an external IP address. Which KQL operator should the analyst use to identify the top source IP addresses and total bytes sent over the last 7 days?
Explanation: The summarize operator with sum() aggregation computes total bytes per source IP, and top 10 limits to the top results. Option A is correct. Option B (where) filters but does not aggregate. Option C (project) only selects columns. Option D (extend) adds computed columns without aggregation.
A threat hunter is using Microsoft Defender for Endpoint advanced hunting to investigate a suspicious process that was observed launching from a temporary folder. The hunter wants to find all devices that have executed this specific process (with the same SHA256 hash) in the last 24 hours. Which table and column should be used in the query?
Explanation: DeviceProcessEvents contains process execution events, and SHA256 stores the hash. Option C is correct. Option A (DeviceFileEvents) is for file creation/modification, not execution. Option B (DeviceNetworkEvents) is for network connections. Option D (DeviceEvents) is a generic table that may not include process hash.
During a threat hunt in Microsoft Sentinel, an analyst creates a custom hunting query that uses the 'externaldata' operator to reference a CSV file stored in Azure Blob Storage. The hunt identifies several suspicious IP addresses that need to be added to a threat intelligence indicator. Which method should the analyst use to persist the findings as indicators of compromise (IOCs) for automated alerting?
Explanation: Option C is correct because Microsoft Sentinel can ingest threat intelligence from custom CSV files via a Threat Intelligence - Upload Indicators API or TAXII connector; the analyst can upload the CSV as a new threat intelligence feed. Option A (watchlist) is for temporary lookups, not persistent IOCs for detection. Option B (custom analytics rule) would require the rule to reference the data, but the IOCs are not stored as indicators. Option D (Azure Logic Apps) could automate but is not the primary method for persisting IOCs.
A security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to detect when a user account has been used to log in from an unusual location and then immediately performs a password reset for another user. Which hunting approach is most effective for this scenario?
Explanation: Option B (KQL query using join between two tables) is correct because it allows correlating login events from one table with password reset events from another table, combining the two conditions. Option A (single table) cannot correlate two different event types. Option C (watchlist) is for static data, not real-time correlation. Option D (playbook) is for automated response, not hunting.
A threat hunter is investigating a potential malware outbreak in Microsoft Defender for Cloud Apps. The hunter notices that multiple users have installed a new app with high permissions that accesses their email. The app was not requested by IT. What is the most effective way to hunt for all instances of this app across the organization?
Explanation: Option D (use the Activity log to search for app installations and then investigate using App Governance or Cloud App Security) is correct because it first identifies the app via installations and then uses app analytics to scope all instances. Option A (conditional access policy) is reactive and not hunting. Option B (alerts) only catches known threats. Option C (OAuth apps page) can list apps but may not show all historical installations; activity log is more comprehensive for hunting.
+15 more Perform threat hunting questions available
Practice all Perform threat hunting questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Perform threat hunting. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Perform threat hunting questions on the SC-200 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Perform threat hunting is tested as part of the Microsoft Security Operations Analyst SC-200 blueprint. Practicing with targeted Perform threat hunting questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free SC-200 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Perform threat hunting is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Perform threat hunting practice session with instant scoring and detailed explanations.
Start Perform threat hunting Practice →