SC-200 Perform threat hunting Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Block the IP address in Microsoft Defender for Cloud Apps.

  Why it's wrong here

  Blocking a single anonymizer IP address in Microsoft Defender for Cloud Apps is a reactive containment action that lacks the context needed for a proper threat hunt. This type of IP is often dynamic or shared by many legitimate users across the internet, so prematurely blocking it can disrupt productivity without verifying whether an actual compromise occurred. The first priority should be to scope the incident by reviewing affected accounts and endpoints, leaving blocking as a targeted remediation step only after evidence supports it.

• ✗

  Create an analytics rule in Microsoft Sentinel to alert on all anonymizer IP addresses.

  Why it's wrong here

  Creating a Microsoft Sentinel analytics rule that alerts on all anonymizer IP addresses is a broad, low-fidelity detection likely to generate a high volume of false positives, since VPNs, Tor exit nodes, and commercial proxies are commonly used for legitimate purposes. This approach does not address the current suspicious activity already noticed; it merely adds noise to the alert pipeline while shifting focus away from the immediate investigation. Threat hunting is hypothesis-driven and entity-centric, not based on blanket alerting for a single weak indicator like a public anonymizer IP.

• ✓

  Initiate an investigation by reviewing the impacted user accounts and endpoints for signs of compromise.

  Why this is correct

  The correct initial action in a threat hunt is to pivot from the observed indicator—the anonymizer IP—to the associated entities, specifically the impacted user accounts and endpoints, and examine authentication logs, behavioral anomalies, and device telemetry for evidence of unauthorized access or lateral movement. Microsoft Defender XDR provides integrated signals such as IdentityLogonEvents, DeviceNetworkEvents, and alerts that enable this scoping, aligning with the MITRE ATT&CK technique of discovering the full attack surface. Only after determining whether accounts are compromised and what systems are affected can you make informed decisions on containment and remediation.

• ✗

  Report the IP to the Microsoft Sentinel Threat Intelligence team.

  Why it's wrong here

  Reporting a single suspicious IP address to a 'Microsoft Sentinel Threat Intelligence team' is not a defined or established workflow in Microsoft Defender XDR; threat intelligence submissions typically occur after internal validation and for confirmed indicators of compromise, not as a reflexive first step. This action provides no investigative value for the current threat hunt and does not help determine whether the anonymizer IP is actually malicious in this specific context. The proper sequence is to conduct internal forensics on the impacted entities first, then optionally share verified indicators with threat intelligence platforms if they prove relevant.

Go deeper

Related to this question