Courseiva

MS-102 DeviceEvents Practice Question

A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should fire when a Windows device exhibits this sequence of events within 3 minutes: 1) A PowerShell process runs with an encoded command, 2) A service is created with a random name, and 3) An outbound network connection to a suspicious IP address is observed. Which three Advanced Hunting tables must be joined in the KQL query to create this detection?

⚠ Common exam trap

The trap is that candidates may think service creation can be captured via DeviceRegistryEvents (because services have registry keys) or DeviceFileEvents (because service binaries are files), but Microsoft specifically logs service creation as a security event in DeviceEvents (Event ID 4697). Only DeviceEvents contains the direct service creation event records.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

DeviceProcessEvents, DeviceEvents, DeviceNetworkEvents

Only option C is correct. The detection rule requires three event types: PowerShell process execution (DeviceProcessEvents), service creation (DeviceEvents, specifically Event ID 4697), and outbound network connection to a suspicious IP (DeviceNetworkEvents). DeviceRegistryEvents captures registry modifications, not the service creation event itself. DeviceFileEvents captures file creation, but service creation is a security event logged in DeviceEvents. Therefore, only the combination in option C includes all necessary tables.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • DeviceProcessEvents, DeviceRegistryEvents, DeviceNetworkEvents

    Why it's wrong here

    Incorrect. DeviceRegistryEvents does not directly capture service creation events; it captures registry modifications. While services have registry keys, the specific event of service creation is logged as a security event in DeviceEvents (Event ID 4697). Therefore, this combination would miss the required event.

  • DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents

    Why it's wrong here

    Incorrect. DeviceFileEvents captures file creation events, such as when a service executable is created, but it does not capture the service creation event itself. Service creation is logged in DeviceEvents. Thus, this combination is insufficient.

  • DeviceProcessEvents, DeviceEvents, DeviceNetworkEvents

    Why this is correct

    Correct. DeviceProcessEvents captures PowerShell process execution, DeviceEvents captures service creation events (Event ID 4697), and DeviceNetworkEvents captures outbound network connections. This combination covers all three required events.

  • DeviceProcessEvents, DeviceLogonEvents, DeviceNetworkEvents

    Why it's wrong here

    Incorrect. DeviceLogonEvents captures logon events, which are not required for this detection rule. It does not cover service creation or network connections.

About these practice questions

This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.