Using Advanced Hunting to Search for Indicators of Compromise in Microsoft Defender for Endpoint
Your organization uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on several endpoints. Which feature allows you to search for indicators of compromise (IOCs) across all endpoints?
Quick Answer
The answer is Advanced hunting, which is the correct feature for searching for indicators of compromise across all endpoints in Microsoft Defender for Endpoint. This tool allows security analysts to run powerful Kusto Query Language (KQL) queries against raw, long-term data from your endpoints, enabling you to proactively hunt for patterns, anomalies, and specific IOCs like file hashes or IP addresses that signal a malware outbreak. On the SC-900 exam, this question tests your understanding of the different Defender for Endpoint capabilities—specifically distinguishing between reactive alerting and proactive hunting. A common trap is confusing Advanced hunting with the Threat analytics dashboard, which provides curated threat intelligence and reports but does not allow you to write custom queries to search across your own environment. Remember: if you need to write a query to find IOCs, think "Advanced hunting." For a quick memory tip, associate "Advanced" with "active querying" and "Threat analytics" with "passive reading."
⚠ Common exam trap
Many candidates confuse the reactive alert management in Incidents and alerts with the proactive, query-based hunting capability of Advanced hunting, often overlooking that only Advanced hunting supports raw IOC searches across historical endpoint data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Advanced hunting
Advanced hunting in Microsoft Defender for Endpoint is a query-based threat hunting tool that allows security analysts to search for indicators of compromise (IOCs) across all endpoints using the Kusto Query Language (KQL). It provides access to raw, schema-based tables (e.g., DeviceEvents, DeviceFileEvents, DeviceNetworkEvents) for up to 30 days of historical data, enabling proactive detection of malware outbreak patterns across the entire fleet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Incidents and alerts
Why it's wrong here
Incidents and alerts show triggered events, not search for custom IOCs.
- ✓
Advanced hunting
Why this is correct
Advanced hunting uses KQL to search for IOCs across endpoints in Defender for Endpoint.
- ✗
Threat analytics
Why it's wrong here
Threat analytics provides overview of threats but not interactive search across endpoints.
- ✗
Device inventory
Why it's wrong here
Device inventory lists devices but does not allow searching for IOCs.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses Microsoft Defender for Endpoint (MDE). The security team wants to identify devices that have not received a security update in the last 30 days. Which report should they use?
easy- A.Threat analytics report
- ✓ B.Device health report
- C.Vulnerability management dashboard
- D.Microsoft Secure Score report
Why B: The Device health report in Microsoft Defender for Endpoint provides a list of devices and their last security update status, including the date of the last update. This report directly answers the requirement to identify devices that have not received a security update in the last 30 days by showing the 'Last update' column and allowing filtering by update age.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.