MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
This MS-102 practice question tests your understanding of manage security and threats by using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: deviceProcessEvents tracks process creation, termination, and parent-child relationships.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user opens a malicious Office document, which launches a process named cmd.exe from Microsoft Word, and then that cmd.exe process makes an outbound connection to a known malicious IP address. Which two Advanced Hunting tables must be joined in the KQL query?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceProcessEvents and DeviceNetworkEvents
Option B is correct because the detection rule requires tracking the process creation (cmd.exe launched from Microsoft Word) and the subsequent network connection from that process to a malicious IP. DeviceProcessEvents captures process creation events, including parent-child relationships, while DeviceNetworkEvents captures outbound network connections initiated by processes. Joining these tables on DeviceId and ProcessId allows correlating the specific cmd.exe instance with its network activity.
Key principle: DeviceProcessEvents tracks process creation, termination, and parent-child relationships.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
EmailEvents and EmailUrlInfo
Why it's wrong here
These tables are for email and URL events, not process or network activity.
✓
DeviceProcessEvents and DeviceNetworkEvents
Why this is correct
DeviceProcessEvents tracks process creation; DeviceNetworkEvents tracks outbound network connections.
Related concept
DeviceProcessEvents tracks process creation, termination, and parent-child relationships.
✗
DeviceEvents and DeviceLogonEvents
Why it's wrong here
DeviceEvents covers various events but not specific process-to-network correlation; DeviceLogonEvents is for logon activity.
✓
DeviceProcessEvents and DeviceRegistryEvents
Why this is correct
DeviceRegistryEvents tracks registry changes, not network connections.
Related concept
DeviceProcessEvents tracks process creation, termination, and parent-child relationships.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse the tables needed for process-level network correlation with those for email or registry events, leading them to select options that capture unrelated telemetry (e.g., email links or registry changes) instead of the precise process-to-network chain.
Detailed technical explanation
How to think about this question
Under the hood, DeviceProcessEvents uses the ProcessId and InitiatingProcessId fields to establish parent-child process chains, while DeviceNetworkEvents uses ProcessId to link network flows to the responsible process. In this scenario, the join would typically be on DeviceId and ProcessId (or InitiatingProcessId for the parent), ensuring the cmd.exe spawned by Word is the same process making the outbound connection. A real-world nuance: if cmd.exe is a child of Word, the join might use InitiatingProcessId from DeviceNetworkEvents to match the parent Word process, but the question specifies 'that cmd.exe process makes an outbound connection,' so a direct ProcessId join on the cmd.exe instance is appropriate.
KKey Concepts to Remember
DeviceProcessEvents tracks process creation, termination, and parent-child relationships.
DeviceNetworkEvents records outbound and inbound network connections by processes.
Joining tables in Advanced Hunting allows correlation of disparate event types.
KQL's 'join' operator is used to combine rows from two or more tables based on related columns.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
DeviceProcessEvents tracks process creation, termination, and parent-child relationships.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Review deviceProcessEvents tracks process creation, termination, and parent-child relationships., then practise related MS-102 questions on the same topic to reinforce the concept.
Manage security and threats by using Microsoft Defender XDR — This question tests Manage security and threats by using Microsoft Defender XDR — DeviceProcessEvents tracks process creation, termination, and parent-child relationships..
What is the correct answer to this question?
The correct answer is: DeviceProcessEvents and DeviceNetworkEvents — Option B is correct because the detection rule requires tracking the process creation (cmd.exe launched from Microsoft Word) and the subsequent network connection from that process to a malicious IP. DeviceProcessEvents captures process creation events, including parent-child relationships, while DeviceNetworkEvents captures outbound network connections initiated by processes. Joining these tables on DeviceId and ProcessId allows correlating the specific cmd.exe instance with its network activity.
What should I do if I get this MS-102 question wrong?
Review deviceProcessEvents tracks process creation, termination, and parent-child relationships., then practise related MS-102 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
DeviceProcessEvents tracks process creation, termination, and parent-child relationships.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.