SC-200 Perform threat hunting Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a custom analytics rule

  Why it's wrong here

  Custom analytics rules are scheduled detection mechanisms that generate alerts and incidents based on a predefined KQL query, not interactive hunting tools. Because they run on a fixed schedule with explicit detection logic, they cannot be used to initiate an ad-hoc hunting query in the Hunting blade. To hunt, you need a query you run manually; an analytics rule is the end product of a detection workflow, not a starting point for exploration.

• ✗

  Import a watchlist as a hunting query

  Why it's wrong here

  Importing a watchlist has no relation to initiating a hunt: a watchlist is a static set of data (such as IP addresses or usernames) stored in Microsoft Sentinel for enrichment, not a KQL query file. You can reference watchlists inside a hunting query using the _GetWatchlist function to correlate data, but the watchlist itself cannot be executed as a query. Therefore, importing one cannot begin a hunting session.

• ✓

  Start from a specific detection rule

  Why this is correct

  Starting from a detection rule is a valid method because the rule's underlying KQL query exposes the same log data used for detection and can be run interactively in the Logs or Hunting blade to explore broader patterns. For example, you can right-click a rule, select 'Run query' to see its results, then refine the query to look for related activity. This pivot from a deterministic detection to a broader investigation is a recognized hunting entry point in Microsoft Sentinel.

• ✓

  Use a predefined hunting query from the Microsoft Sentinel content hub

  Why this is correct

  The Microsoft Sentinel content hub offers out-of-the-box hunting queries developed by Microsoft and the security community, which you can install and run directly from the Hunting blade. These predefined KQL queries are purpose-built to initiate hunts for specific attack techniques, such as credential access or lateral movement. Using them is a standard, supported way to start hunting without writing a query from scratch.

• ✗

  Enable live mode on a hunting query

  Why it's wrong here

  There is no 'live mode' feature for hunting queries in Microsoft Sentinel; all hunting queries are executed on demand in the Hunting blade or Logs. You can schedule a query by converting it into an analytics rule, but that turns it into a detection rule, not a live-mode hunt. Because hunting is an interactive, iterative process, the option name itself is invalid.

Go deeper

Related to this question