MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security analyst wants to create a custom detection rule in Microsoft 365 Defender that triggers when a PowerShell process with suspicious command-line arguments is detected on a device, and within 5 minutes, an outbound network connection to a known malicious IP occurs. Which two advanced hunting tables must be joined in the KQL query?
⚠ Common exam trap
The trap is that candidates may think DeviceEvents (which sounds like it covers all events) can substitute for DeviceNetworkEvents, but DeviceEvents does not include network connection telemetry needed for this correlation. Only DeviceProcessEvents plus DeviceNetworkEvents provide the precise data for process-to-network correlation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceProcessEvents and DeviceNetworkEvents
The detection rule requires correlating a PowerShell process event with an outbound network connection to a known malicious IP within 5 minutes. The correct approach is to join DeviceProcessEvents (for process details) with DeviceNetworkEvents (for network connections) on device ID and timestamp within the time window. Option C is incorrect because DeviceEvents does not reliably contain network connection data; it is intended for other event types. Option B is incorrect because EmailEvents is for email events, not endpoint process or network data. Option D is incorrect because IdentityLogonEvents covers authentication events, not process or network activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeviceProcessEvents and DeviceNetworkEvents
Why this is correct
Correct. DeviceProcessEvents provides process details, and DeviceNetworkEvents provides network connections; joining them on device ID and timestamp allows correlation within the 5-minute window.
- ✗
EmailEvents and DeviceNetworkEvents
Why it's wrong here
Incorrect. EmailEvents is for email-related events, not endpoint process or network data, so it is irrelevant to this detection rule.
- ✗
DeviceEvents and DeviceProcessEvents
Why it's wrong here
Incorrect. DeviceEvents does not reliably contain network connection events; DeviceNetworkEvents is specifically designed for network telemetry and should be used instead.
- ✗
IdentityLogonEvents and DeviceNetworkEvents
Why it's wrong here
Incorrect. IdentityLogonEvents covers authentication events, not process or network activities, so it is not suitable for this detection rule.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.