SC-200 — Frequently Asked Questions
Community-vetted answers to 2 common questions about this exam.
Questions from real practice questions
Each Q&A comes from a specific community question — follow the link for its full analysis.
Creating Custom Tracked Queries in Microsoft Defender
Advanced Hunting is for manual, ad-hoc investigation using KQL. Threat Analytics is for saving and automating those queries as 'trackers' to continuously monitor for threats.
Yes, you can run any KQL query in Advanced Hunting. However, only by saving it as a tracker in Threat Analytics does it become a persistent assessment tool for the subscription's status.
Ready to practice?
Access 80 SC-200 questions with instant feedback and detailed explanations.
View SC-200 Practice Questions →← Back to SC-200 Microsoft Security Operations Analyst Study Guide