SC-200 Certification Practice Question #24

Question

You have a Microsoft 365 subscription that uses Microsoft 365 Defender.

You plan to create a hunting query from Microsoft Defender.

You need to create a custom tracked query that will be used to assess the threat status of the subscription.

From the Microsoft 365 Defender portal, which page should you use to create the query?

Accepted Answer

Creating a custom, saved/tracked query to assess threat status is the core purpose of the Advanced Hunting page, which provides a KQL query editor where queries are written, saved, and reused (and can be promoted to custom detection rules). Suggested Answer, the unanimous Most Voted, both Highly Voted comments (12 and 5 👍), and MS Learn all agree, with no meaningful dissent — hence high confidence.

More SC-200 practice questions