The answer is DeviceNetworkEvents. This table is the correct primary data source because it records every network connection event on a device, including source and destination IP addresses, ports, and protocols, which is exactly what you need to analyze for a network connection to malicious IP detection. In the context of the Microsoft 365 Administrator MS-102 exam, this question tests your ability to map a security detection requirement to the correct advanced hunting schema in Microsoft Defender XDR. A common trap is confusing DeviceNetworkEvents with IdentityLogonEvents or EmailEvents, which cover authentication and email traffic, not raw network connections. Remember the memory tip: if it involves a device talking to an IP over the network, think "DeviceNetworkEvents" — the "Network" in the name is your clue that it holds the raw connection data for command-and-control detection.
MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
This MS-102 practice question tests your understanding of manage security and threats by using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: deviceNetworkEvents logs all network connections made by devices.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a device establishes a network connection to an IP address that has been recently observed in threat intelligence feeds as a new, malicious command-and-control server. The rule should analyze network communication events. Which advanced hunting table should be the primary data source for the Kusto Query Language (KQL) query?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "primary"
Why it matters: Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceNetworkEvents
DeviceNetworkEvents is the correct primary data source because it captures network connection events, including source and destination IP addresses, ports, and protocols. To detect a device connecting to a newly observed malicious command-and-control server, the KQL query must analyze network communication events, which are stored exclusively in this table.
Key principle: DeviceNetworkEvents logs all network connections made by devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
DeviceProcessEvents
Why it's wrong here
DeviceProcessEvents logs process creation events, not network connections.
✓
DeviceNetworkEvents
Why this is correct
This table records network connection events such as TCP, UDP, and ICMP traffic, making it suitable for IP-based detection.
Clue confirmation
The clue word "primary" in the question point toward this answer.
Related concept
DeviceNetworkEvents logs all network connections made by devices.
✗
EmailEvents
Why it's wrong here
EmailEvents captures email delivery data, not network connections from devices.
✗
AlertEvidence
Why it's wrong here
AlertEvidence contains information about alerts and associated entities, not raw network events.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Microsoft often tests the confusion between process-level and network-level tables, leading candidates to choose DeviceProcessEvents because they mistakenly think process creation is the primary indicator of malicious network activity.
Detailed technical explanation
How to think about this question
The DeviceNetworkEvents table includes fields such as RemoteIP, RemotePort, Protocol, and ActionType, enabling precise filtering for outbound connections to specific IPs. When integrating threat intelligence, you can join this table with an external data source containing newly observed C2 IPs using a left anti-join or inner join to trigger on matches. A real-world scenario might involve detecting a device beaconing to a known C2 IP that was added to a threat intelligence feed within the last hour, requiring a time-bound join.
KKey Concepts to Remember
DeviceNetworkEvents logs all network connections made by devices.
It includes details like local/remote IP, port, and protocol.
Essential for detecting outbound connections to suspicious IPs.
Used for KQL queries analyzing TCP, UDP, and ICMP traffic.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
DeviceNetworkEvents logs all network connections made by devices.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Review deviceNetworkEvents logs all network connections made by devices., then practise related MS-102 questions on the same topic to reinforce the concept.
Manage security and threats by using Microsoft Defender XDR — This question tests Manage security and threats by using Microsoft Defender XDR — DeviceNetworkEvents logs all network connections made by devices..
What is the correct answer to this question?
The correct answer is: DeviceNetworkEvents — DeviceNetworkEvents is the correct primary data source because it captures network connection events, including source and destination IP addresses, ports, and protocols. To detect a device connecting to a newly observed malicious command-and-control server, the KQL query must analyze network communication events, which are stored exclusively in this table.
What should I do if I get this MS-102 question wrong?
Review deviceNetworkEvents logs all network connections made by devices., then practise related MS-102 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "primary". Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
What is the key concept behind this question?
DeviceNetworkEvents logs all network connections made by devices.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.