MS-102 DeviceEvents Practice Question
A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should fire when a Windows device exhibits this sequence of events within 3 minutes: 1) A PowerShell process runs with an encoded command, 2) A service is created with a random name, and 3) An outbound network connection to a suspicious IP address is observed. Which three Advanced Hunting tables must be joined in the KQL query to create this detection?
⚠ Common exam trap
The trap is that candidates may think service creation can be captured via DeviceRegistryEvents (because services have registry keys) or DeviceFileEvents (because service binaries are files), but Microsoft specifically logs service creation as a security event in DeviceEvents (Event ID 4697). Only DeviceEvents contains the direct service creation event records.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceProcessEvents, DeviceEvents, DeviceNetworkEvents
Only option C is correct. The detection rule requires three event types: PowerShell process execution (DeviceProcessEvents), service creation (DeviceEvents, specifically Event ID 4697), and outbound network connection to a suspicious IP (DeviceNetworkEvents). DeviceRegistryEvents captures registry modifications, not the service creation event itself. DeviceFileEvents captures file creation, but service creation is a security event logged in DeviceEvents. Therefore, only the combination in option C includes all necessary tables.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DeviceProcessEvents, DeviceRegistryEvents, DeviceNetworkEvents
Why it's wrong here
Incorrect. DeviceRegistryEvents does not directly capture service creation events; it captures registry modifications. While services have registry keys, the specific event of service creation is logged as a security event in DeviceEvents (Event ID 4697). Therefore, this combination would miss the required event.
- ✗
DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents
Why it's wrong here
Incorrect. DeviceFileEvents captures file creation events, such as when a service executable is created, but it does not capture the service creation event itself. Service creation is logged in DeviceEvents. Thus, this combination is insufficient.
- ✓
DeviceProcessEvents, DeviceEvents, DeviceNetworkEvents
Why this is correct
Correct. DeviceProcessEvents captures PowerShell process execution, DeviceEvents captures service creation events (Event ID 4697), and DeviceNetworkEvents captures outbound network connections. This combination covers all three required events.
- ✗
DeviceProcessEvents, DeviceLogonEvents, DeviceNetworkEvents
Why it's wrong here
Incorrect. DeviceLogonEvents captures logon events, which are not required for this detection rule. It does not cover service creation or network connections.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.