The answer is the DeviceNetworkEvents table in Microsoft Defender XDR. This advanced hunting schema is the correct primary data source because it specifically records every network connection initiated from a device, including the destination IP address, port, and the full process filename and process ID of the application that made the connection. For a custom detection rule that must trigger on a known malicious IP and a specific malware-associated port while also capturing the initiating process’s filename, DeviceNetworkEvents provides all required fields in a single, normalized table. On the MS-102 exam, this question tests your ability to map a security requirement to the correct advanced hunting schema, often trying to trap you with DeviceNetworkInfo (which only stores network configuration, not live connections) or DeviceProcessEvents (which lacks network details). A reliable memory tip is to think “NetworkEvents = Network Connections,” so if the rule involves an IP and port, start here.
MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
This MS-102 practice question tests your understanding of manage security and threats by using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: deviceNetworkEvents tracks all network connections from devices.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst needs to create a custom detection rule in Microsoft Defender XDR that triggers when a user's device establishes a network connection to a known malicious IP address on a port commonly used by a specific malware. The rule must also include process information such as the filename of the process that initiated the connection. Which advanced hunting table should be the primary data source for this rule?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "primary"
Why it matters: Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
Correct. This table includes network connection events with details like remote IP, port, and initiating process filename, allowing direct rule creation.
B
DeviceProcessEvents
Why wrong: Incorrect. This table records process creation events but does not contain network connection details such as destination IP or port.
C
DeviceFileEvents
Why wrong: Incorrect. This table logs file creation, modification, and deletion events, not network connections.
D
IdentityLogonEvents
Why wrong: Incorrect. This table captures authentication events (logons) and does not provide network connection data.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceNetworkEvents
The DeviceNetworkEvents table in Microsoft Defender XDR captures network connection events, including source and destination IP addresses, ports, and the initiating process's filename and ID. This makes it the ideal primary data source for a custom detection rule that must trigger on a specific malicious IP and port combination while also providing process information.
Key principle: DeviceNetworkEvents tracks all network connections from devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
DeviceNetworkEvents
Why this is correct
Correct. This table includes network connection events with details like remote IP, port, and initiating process filename, allowing direct rule creation.
Clue confirmation
The clue word "primary" in the question point toward this answer.
Related concept
DeviceNetworkEvents tracks all network connections from devices.
✗
DeviceProcessEvents
Why it's wrong here
Incorrect. This table records process creation events but does not contain network connection details such as destination IP or port.
✗
DeviceFileEvents
Why it's wrong here
Incorrect. This table logs file creation, modification, and deletion events, not network connections.
✗
IdentityLogonEvents
Why it's wrong here
Incorrect. This table captures authentication events (logons) and does not provide network connection data.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse DeviceProcessEvents (which includes process command lines) as sufficient for network detection, overlooking that it lacks the network-specific fields (RemoteIP, RemotePort) required to match a malicious IP and port combination.
Detailed technical explanation
How to think about this question
The DeviceNetworkEvents table is populated by the Microsoft Defender for Endpoint network protection sensor, which uses Windows Filtering Platform (WFP) to intercept and log outbound connections at the kernel level. This table includes fields like RemoteIP, RemotePort, LocalIP, LocalPort, InitiatingProcessFileName, and InitiatingProcessId, enabling precise correlation of process-to-network activity. In a real-world scenario, a rule querying this table could detect a PowerShell process connecting to a known C2 server on TCP 443, even if the traffic is encrypted.
KKey Concepts to Remember
DeviceNetworkEvents tracks all network connections from devices.
It includes remote IP, port, protocol, and connection status.
Crucially, it contains InitiatingProcessFileName for process attribution.
Ideal for detecting C2 communication and suspicious outbound connections.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
DeviceNetworkEvents tracks all network connections from devices.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Review deviceNetworkEvents tracks all network connections from devices., then practise related MS-102 questions on the same topic to reinforce the concept.
Manage security and threats by using Microsoft Defender XDR — This question tests Manage security and threats by using Microsoft Defender XDR — DeviceNetworkEvents tracks all network connections from devices..
What is the correct answer to this question?
The correct answer is: DeviceNetworkEvents — The DeviceNetworkEvents table in Microsoft Defender XDR captures network connection events, including source and destination IP addresses, ports, and the initiating process's filename and ID. This makes it the ideal primary data source for a custom detection rule that must trigger on a specific malicious IP and port combination while also providing process information.
What should I do if I get this MS-102 question wrong?
Review deviceNetworkEvents tracks all network connections from devices., then practise related MS-102 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "primary". Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
What is the key concept behind this question?
DeviceNetworkEvents tracks all network connections from devices.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.