Question 953 of 1,250
SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security analyst is using Microsoft 365 Defender to investigate a sophisticated multi-stage attack. The analyst needs to query data across endpoints, email, and identity logs to identify the attacker's behavior patterns and correlate events. Which Microsoft 365 Defender capability should the analyst use?
⚠ Common exam trap
Watch out — candidates often confuse 'Advanced hunting' with 'Threat analytics' because both involve investigating threats, but Threat analytics is a passive reading tool for pre-built reports, while Advanced hunting is an active, custom query engine for raw data correlation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Advanced hunting
Advanced hunting is the correct capability because it provides a Kusto Query Language (KQL)-based query interface that allows the security analyst to perform custom, cross-domain searches across data from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), and identity logs (Microsoft Defender for Identity). This enables the correlation of events and identification of attacker behavior patterns across a multi-stage attack, which is not possible with the other options.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Automated investigation and response
Why it's wrong here
Automated investigation and response (AIR) capabilities in Microsoft 365 Defender are designed to automatically examine alerts, apply predefined playbooks to investigate potential threats, and then take or recommend immediate remediation actions. Its primary goal is to accelerate incident response, reduce alert fatigue, and contain threats rapidly without requiring constant manual intervention. AIR focuses on automated execution and response, rather than providing a platform for security analysts to conduct custom, ad-hoc data queries.
When this WOULD be correct
A security analyst needs to automatically contain a confirmed malware outbreak across multiple endpoints. In that scenario, Automated investigation and response would be the correct answer because it triggers automated remediation actions based on alerts.
- ✗
Threat analytics
Why it's wrong here
Threat analytics provides expert-driven intelligence and reports from Microsoft security researchers on the most relevant and active threats, vulnerabilities, and attack campaigns. It offers a comprehensive overview of how these threats might impact an organization, along with recommended mitigations and an assessment of the organization's exposure. While invaluable for understanding the threat landscape, it does not offer interactive query capabilities for an organization's specific raw security data.
When this WOULD be correct
A security analyst wants to understand the latest threat landscape and review detailed reports on active threat actors, including their techniques and recommended mitigations. Threat analytics would be the correct capability to use.
- ✓
Advanced hunting
Why this is correct
Advanced hunting is a powerful, proactive threat hunting tool within Microsoft 365 Defender that allows security analysts to explore raw organizational data using Kusto Query Language (KQL). It aggregates data from endpoints, email, identity, and cloud apps, enabling custom queries to uncover sophisticated threats, identify anomalous behaviors, and correlate events across diverse security domains that automated systems might miss. This capability is crucial for deep investigations and creating custom detection rules.
- ✗
Action center
Why it's wrong here
The Action center in Microsoft 365 Defender serves as a centralized hub for managing and reviewing remediation actions initiated by automated investigations or manual security operations. It displays the status of pending and completed actions, such as isolating devices or blocking files, allowing analysts to approve, reject, or view details of these operational tasks. However, it is designed for action management and oversight, not for performing live data queries or custom threat hunting.
When this WOULD be correct
An exam question asks: 'After an automated investigation in Microsoft 365 Defender has completed, where should an analyst go to review and approve pending remediation actions such as deleting malicious files or blocking IP addresses?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Advanced huntingCorrect answer▾
Why this is correct
Advanced hunting is a powerful, proactive threat hunting tool within Microsoft 365 Defender that allows security analysts to explore raw organizational data using Kusto Query Language (KQL). It aggregates data from endpoints, email, identity, and cloud apps, enabling custom queries to uncover sophisticated threats, identify anomalous behaviors, and correlate events across diverse security domains that automated systems might miss. This capability is crucial for deep investigations and creating custom detection rules.
✗Automated investigation and responseWrong answer — click to see why▾
Why this is wrong here
Automated investigation and response (AIR) automates incident response actions, but the question requires querying and correlating data across endpoints, email, and identity logs, which is the purpose of Advanced hunting, not AIR.
★ When this WOULD be the correct answer
A security analyst needs to automatically contain a confirmed malware outbreak across multiple endpoints. In that scenario, Automated investigation and response would be the correct answer because it triggers automated remediation actions based on alerts.
Why candidates choose this
Candidates may confuse automated investigation with manual hunting, thinking that 'investigation' includes querying logs, but AIR is about automated response, not ad-hoc data exploration.
✗Threat analyticsWrong answer — click to see why▾
Why this is wrong here
Threat analytics provides threat intelligence reports and insights about known threats, but it does not allow the analyst to query raw data across endpoints, email, and identity logs for custom correlation and pattern identification.
★ When this WOULD be the correct answer
A security analyst wants to understand the latest threat landscape and review detailed reports on active threat actors, including their techniques and recommended mitigations. Threat analytics would be the correct capability to use.
Why candidates choose this
Candidates may confuse threat analytics with advanced hunting because both involve investigating threats, but threat analytics focuses on pre-built intelligence rather than custom queries.
✗Action centerWrong answer — click to see why▾
Why this is wrong here
The Action center is used to view and manage remediation actions taken by automated investigations, not for querying raw data across endpoints, email, and identity logs to correlate events.
★ When this WOULD be the correct answer
An exam question asks: 'After an automated investigation in Microsoft 365 Defender has completed, where should an analyst go to review and approve pending remediation actions such as deleting malicious files or blocking IP addresses?'
Why candidates choose this
Candidates may confuse the Action center with a central place for all security operations, including data querying, because it aggregates actions from multiple Microsoft 365 Defender components.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.