nerdexam
Microsoft

SC-200 · Question #171

You have a Microsoft 365 subscription that uses Microsoft 365 Defender. You plan to create a hunting query from Microsoft Defender. You need to create a custom tracked query that will be used to…

The correct answer is B. Advanced Hunting. "Use Advance mode if you're comfortable creating custom queries." https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting- overview?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting…

Submitted by femi9· Apr 18, 2026Perform threat hunting

Question

You have a Microsoft 365 subscription that uses Microsoft 365 Defender. You plan to create a hunting query from Microsoft Defender. You need to create a custom tracked query that will be used to assess the threat status of the subscription. From the Microsoft 365 Defender portal, which page should you use to create the query?

Options

  • AThreat analytics
  • BAdvanced Hunting
  • CExplorer
  • DPolicies & rules

How the community answered

(69 responses)
  • A
    1% (1)
  • B
    94% (65)
  • C
    1% (1)
  • D
    3% (2)

Explanation

"Use Advance mode if you're comfortable creating custom queries." https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting- overview?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting- modes?view=o365-worldwide#get-started-with-guided-hunting-mode

Topics

#Advanced Hunting#Threat Hunting#Microsoft 365 Defender#Custom Queries

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-200 Practice