SC-200 Perform threat hunting Practice Question
During a threat hunt, you identify a suspicious process that spawned from Microsoft Word with a command-line argument containing ' -enc '. Which hunting technique is most appropriate to investigate this further?
⚠ Common exam trap
SC-200 often tests the misconception that the '-enc' argument itself must be manually decoded to investigate. In reality, PowerShell script block logging (Event ID 4104) captures the decoded script block content, making it the most appropriate hunting technique. Manual decoding is a fallback when logging is not configured or the event is missing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the PowerShell script block logging
The '-enc' argument is a well-known PowerShell parameter indicating a Base64-encoded command, often used by attackers to obfuscate malicious scripts. In Microsoft Defender for Endpoint and SC-200 hunting scenarios, the most appropriate technique is to review PowerShell script block logging (Event ID 4104), which records the decoded script block content and provides the actual PowerShell code executed. This allows the analyst to understand the intent and actions of the suspicious process without manually decoding the argument. While manual decoding can be useful, script block logging is the standard hunting technique that surfaces the decoded command directly in the telemetry.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Review the PowerShell script block logging
Why this is correct
Reviewing PowerShell script block logging could provide additional context, but it is not the most direct way to investigate an encoded command. Decoding the '-enc' argument first yields the actual command.
- ✗
Initiate network traffic analysis for the host
Why it's wrong here
Network traffic analysis might reveal communications but is a secondary step; the immediate need is to understand the encoded payload.
- ✗
Check the file hash against threat intelligence feeds
Why it's wrong here
Checking the file hash is useful for known malware but the encoded argument needs to be decoded to see the command regardless.
- ✗
Decode the base64-encoded command-line argument
Why it's wrong here
The '-enc' switch tells PowerShell to execute a Base64-encoded command, a common obfuscation used by malicious macros. Decoding that argument reveals the actual script, letting the hunter confirm intent and extract indicators rather than guessing from the encoded blob.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.