SC-200 Perform threat hunting Practice Question
Which TWO techniques are commonly used in threat hunting to identify potential malicious activity? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Searching for known indicators of compromise (IoCs).
Searching for known indicators of compromise (IoCs) is a fundamental threat hunting technique, allowing hunters to identify known malicious activity. Option C is correct because analyzing anomalies in baseline behavior helps detect deviations that may indicate unknown threats, a core proactive hunting approach. Option B is wrong because disabling security controls is dangerous and not a legitimate hunting technique; threat hunting should not weaken defenses. Option D is wrong because waiting for automated alerts is reactive, not proactive hunting. Option E is wrong because automatically blocking suspicious traffic is an automated response, not a hunting technique; threat hunting involves human-led investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Searching for known indicators of compromise (IoCs).
Why this is correct
IoCs help identify known threats.
- ✗
Disabling security controls to observe attacker behavior.
Why it's wrong here
This is not a recommended technique.
- ✓
Analyzing anomalies in baseline behavior.
Why this is correct
Anomaly detection is a key hunting method.
- ✗
Waiting for alerts from automated detection tools.
Why it's wrong here
That is reactive, not proactive hunting.
- ✗
Automatically blocking all suspicious traffic.
Why it's wrong here
That is an automated response, not a hunting technique.
Go deeper
Related to this question
About these practice questions
One of 673 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.