The answer is DeviceProcessEvents and DeviceEvents. This is correct because the detection rule requires correlating two distinct event types: process creation, captured in DeviceProcessEvents to identify powershell.exe with the '-EncodedCommand' flag, and service creation, which is logged in DeviceEvents under actions like 'ServiceInstalled' or 'ServiceCreated'. Joining these tables on DeviceId with a 5-minute time window allows the KQL query to link the suspicious process launch to a subsequent service installation on the same device. On the MS-102 exam, this tests your ability to choose the right tables for multi-stage attack detection, a common scenario in Advanced Hunting custom rules. A frequent trap is confusing DeviceEvents with DeviceRegistryEvents—remember that service creation is a system event, not a registry modification. Memory tip: think "Process spawns, service follows" to recall that DeviceProcessEvents catches the launch and DeviceEvents catches the service action.
MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
This MS-102 practice question tests your understanding of manage security and threats by using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: deviceProcessEvents tracks process creation, termination, and command-line details.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a process named 'powershell.exe' is launched with command-line arguments containing '-EncodedCommand', and within 5 minutes a service is created on the same device. Which two Advanced Hunting tables must be joined in the KQL query to create this detection?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceProcessEvents and DeviceEvents
The correct answer is A because the detection rule requires monitoring process creation events (DeviceProcessEvents) to detect powershell.exe with '-EncodedCommand', and then service creation events (DeviceEvents) within 5 minutes on the same device. DeviceEvents captures service-related actions like 'ServiceInstalled' or 'ServiceCreated', which are essential for the second condition. Joining these two tables on DeviceId and a time window allows the KQL query to correlate the two events.
Key principle: DeviceProcessEvents tracks process creation, termination, and command-line details.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
DeviceProcessEvents and DeviceEvents
Why this is correct
DeviceProcessEvents for process creation, DeviceEvents for service creation; both are needed.
Related concept
DeviceProcessEvents tracks process creation, termination, and command-line details.
✗
DeviceProcessEvents and DeviceNetworkEvents
Why it's wrong here
DeviceNetworkEvents does not capture service creation events.
✓
DeviceProcessEvents and DeviceRegistryEvents
Why this is correct
DeviceRegistryEvents captures registry modifications, not service creation.
Related concept
DeviceProcessEvents tracks process creation, termination, and command-line details.
✗
DeviceEvents and DeviceLogonEvents
Why it's wrong here
DeviceLogonEvents does not include process creation, so the initial PowerShell event would be missed.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse DeviceEvents with DeviceRegistryEvents, assuming service creation is a registry operation, but in Windows, service creation is a system event captured by DeviceEvents, not registry changes.
Detailed technical explanation
How to think about this question
In Advanced Hunting, DeviceProcessEvents contains fields like ProcessCommandLine and FileName, making it ideal for filtering powershell.exe with '-EncodedCommand'. DeviceEvents captures a wide range of system-level events, including service creation via ActionType values such as 'ServiceInstalled' or 'ServiceCreated'. The join typically uses a time-bound condition (e.g., within 5 minutes) and DeviceId to ensure the events occur on the same device, leveraging the KQL 'join' operator with 'where' clauses for temporal correlation.
KKey Concepts to Remember
DeviceProcessEvents tracks process creation, termination, and command-line details.
DeviceEvents captures a wide range of system-level security events, including service creation.
Advanced Hunting queries often join multiple tables for comprehensive threat detection.
Time-based correlation is critical for linking sequential events on the same device.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
DeviceProcessEvents tracks process creation, termination, and command-line details.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Review deviceProcessEvents tracks process creation, termination, and command-line details., then practise related MS-102 questions on the same topic to reinforce the concept.
Manage security and threats by using Microsoft Defender XDR — This question tests Manage security and threats by using Microsoft Defender XDR — DeviceProcessEvents tracks process creation, termination, and command-line details..
What is the correct answer to this question?
The correct answer is: DeviceProcessEvents and DeviceEvents — The correct answer is A because the detection rule requires monitoring process creation events (DeviceProcessEvents) to detect powershell.exe with '-EncodedCommand', and then service creation events (DeviceEvents) within 5 minutes on the same device. DeviceEvents captures service-related actions like 'ServiceInstalled' or 'ServiceCreated', which are essential for the second condition. Joining these two tables on DeviceId and a time window allows the KQL query to correlate the two events.
What should I do if I get this MS-102 question wrong?
Review deviceProcessEvents tracks process creation, termination, and command-line details., then practise related MS-102 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
DeviceProcessEvents tracks process creation, termination, and command-line details.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.