MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security analyst wants to create a custom detection rule that triggers when a device communicates with a new, unclassified IP address that has been flagged by Microsoft threat intelligence as potentially malicious. The rule should run every hour and create an incident if more than 5 such communications from the same device occur within a 24-hour window. Which advanced hunting tables should be joined in the KQL query for this rule?
⚠ Common exam trap
Many exam-takers confuse `DeviceNetworkEvents` with `DeviceProcessEvents` or `DeviceFileEvents`, mistakenly thinking process or file events can indicate network communication patterns, or they overlook that `IPReputation` is the specific table providing threat intelligence classification for IP addresses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceNetworkEvents and IPReputation
The rule requires detecting network communications to potentially malicious IP addresses, which involves joining `DeviceNetworkEvents` (which logs network connections from devices) with `IPReputation` (which contains Microsoft's threat intelligence classifications for IP addresses). This join allows the query to filter for communications where the destination IP is flagged as malicious and then aggregate by device to trigger an incident when the count exceeds 5 within a 24-hour window.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeviceNetworkEvents and IPReputation
Why this is correct
DeviceNetworkEvents records network connections including remote IPs. IPReputation provides Microsoft's threat intelligence score for IP addresses, allowing the rule to filter for connections to flagged IPs. These tables can be joined on the RemoteIP column.
- ✗
DeviceProcessEvents and AlertInfo
Why it's wrong here
DeviceProcessEvents tracks process creation—command lines, image hashes, parent processes—but does not expose RemoteIP or any network connection fields, so it cannot identify host communications with a malicious address. AlertInfo describes alerts generated by Microsoft 365 Defender, including AlertTitle and Severity, yet it contains no IP threat-intelligence score and already presumes a detection occurred. Combining these tables cannot recreate the network-level signal or external IP reputation lookup the rule needs.
- ✗
DeviceFileEvents and DeviceIPInfo
Why it's wrong here
DeviceFileEvents captures file creation, rename, and deletion events with columns like FileName, SHA256, and FolderPath, but has no RemoteIP field, making it impossible to correlate a file operation to an outbound connection. DeviceIPInfo is not a real table in the advanced hunting schema—the legitimate threat-intelligence table is IPReputation, which requires matching against a network-side RemoteIP. Without DeviceNetworkEvents as the primary source, this pair cannot express the 'connection to flagged IP' condition.
- ✗
EmailEvents and DeviceNetworkEvents
Why it's wrong here
EmailEvents covers email delivery, not network connections. While DeviceNetworkEvents is correct, joining it with EmailEvents does not provide threat intelligence on the IP. The rule would not know if the IP is flagged as malicious.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.