The correct answer is EmailAttachmentInfo and DeviceProcessEvents, because correlating email attachment data with process creation requires joining these two Advanced Hunting tables. EmailAttachmentInfo stores attachment metadata such as file name and SHA256 hash, while DeviceProcessEvents logs every process creation event on endpoints, including the executable’s hash and parent process details. By joining on the SHA256 hash or file name, an analyst can directly trace a malicious attachment to the process it spawned when the user opened it. On the MS-102 exam, this question tests your ability to map real-world attack chains to table schemas—a common trap is choosing EmailEvents instead, which lacks attachment-specific fields. Remember the memory tip: “Attach the hash, spawn the process” to link EmailAttachmentInfo (hash) with DeviceProcessEvents (spawned process).
MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
This MS-102 practice question tests your understanding of manage security and threats by using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: emailAttachmentInfo contains details like file hash (SHA256) for email attachments.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should detect when a user receives a malicious email attachment and then opens the attachment, resulting in a process being created (e.g., .exe file). Which two Advanced Hunting tables must be joined to correlate the email attachment with the resulting process?
EmailEvents provides email metadata but not attachment-specific details like file hash needed for correlation with processes.
B
EmailAttachmentInfo and DeviceProcessEvents
EmailAttachmentInfo has attachment file details (hash, name), and DeviceProcessEvents has process creation. Joining on file hash links the attachment to the spawned process.
C
EmailAttachmentInfo and DeviceFileEvents
Why wrong: DeviceFileEvents tracks file system activities, but the process creation is recorded in DeviceProcessEvents, not DeviceFileEvents.
D
DeviceProcessEvents and IdentityLogonEvents
Why wrong: IdentityLogonEvents are for user logon, not email attachment or process correlation.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EmailEvents and DeviceProcessEvents
Option B is correct because correlating email attachment information with process creation requires joining the EmailAttachmentInfo table (which contains details about attachments like file name and SHA256 hash) with the DeviceProcessEvents table (which logs process creation events). This join allows the analyst to match the attachment's hash or file name to the process that was created when the user opened the attachment, directly linking the malicious email to the resulting executable.
Key principle: EmailAttachmentInfo contains details like file hash (SHA256) for email attachments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
EmailEvents and DeviceProcessEvents
Why this is correct
EmailEvents provides email metadata but not attachment-specific details like file hash needed for correlation with processes.
Related concept
EmailAttachmentInfo contains details like file hash (SHA256) for email attachments.
✓
EmailAttachmentInfo and DeviceProcessEvents
Why this is correct
EmailAttachmentInfo has attachment file details (hash, name), and DeviceProcessEvents has process creation. Joining on file hash links the attachment to the spawned process.
Related concept
EmailAttachmentInfo contains details like file hash (SHA256) for email attachments.
✗
EmailAttachmentInfo and DeviceFileEvents
Why it's wrong here
DeviceFileEvents tracks file system activities, but the process creation is recorded in DeviceProcessEvents, not DeviceFileEvents.
✗
DeviceProcessEvents and IdentityLogonEvents
Why it's wrong here
IdentityLogonEvents are for user logon, not email attachment or process correlation.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse DeviceFileEvents with DeviceProcessEvents, thinking that file events (like saving an attachment) are sufficient, but the question explicitly requires detecting a process being created (execution), which only DeviceProcessEvents captures.
Detailed technical explanation
How to think about this question
Under the hood, the EmailAttachmentInfo table stores the SHA256 hash of the attachment in the SHA256 column, while DeviceProcessEvents stores the SHA256 hash of the executable image in the SHA256 column as well. By joining on SHA256 (or FileName), the analyst can trace the exact attachment that was downloaded and executed, even if the file name was changed. In a real-world scenario, this correlation is critical for detecting zero-day malware where the attachment is a malicious .exe or .docm that spawns a process like regsvr32.exe or powershell.exe.
KKey Concepts to Remember
EmailAttachmentInfo contains details like file hash (SHA256) for email attachments.
DeviceProcessEvents logs process creation, including the executable's file hash.
Joining on file hash is essential to link email attachments to endpoint processes.
Advanced Hunting queries correlate data across Microsoft 365 Defender services.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
EmailAttachmentInfo contains details like file hash (SHA256) for email attachments.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Review emailAttachmentInfo contains details like file hash (SHA256) for email attachments., then practise related MS-102 questions on the same topic to reinforce the concept.
Manage security and threats by using Microsoft Defender XDR — This question tests Manage security and threats by using Microsoft Defender XDR — EmailAttachmentInfo contains details like file hash (SHA256) for email attachments..
What is the correct answer to this question?
The correct answer is: EmailEvents and DeviceProcessEvents — Option B is correct because correlating email attachment information with process creation requires joining the EmailAttachmentInfo table (which contains details about attachments like file name and SHA256 hash) with the DeviceProcessEvents table (which logs process creation events). This join allows the analyst to match the attachment's hash or file name to the process that was created when the user opened the attachment, directly linking the malicious email to the resulting executable.
What should I do if I get this MS-102 question wrong?
Review emailAttachmentInfo contains details like file hash (SHA256) for email attachments., then practise related MS-102 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
EmailAttachmentInfo contains details like file hash (SHA256) for email attachments.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.