Manage security and threats by using Microsoft Defender XDR →hardMultiple ChoiceObjective-mapped

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Refer to the exhibit.

```kusto
// KQL query in Microsoft Defender XDR advanced hunting
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "cmd.exe")
| where ProcessCommandLine contains "-EncodedCommand"
| project Timestamp, DeviceName, FileName, ProcessCommandLine
| summarize Count = count() by DeviceName
| where Count > 10
```

Refer to the exhibit. You run the KQL query in advanced hunting. What is the primary purpose of this query?

⚠ Common exam trap

It's easy for candidates to confuse 'encoded commands' with 'execution policy bypass' or focus on the presence of PowerShell without recognizing that the specific '-EncodedCommand' parameter is the key indicator of obfuscation and potential malicious activity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Identify devices with high use of encoded commands, which may indicate malicious activity

The KQL query filters for DeviceProcessEvents where the command line contains 'powershell' and the process command line includes '-EncodedCommand', which is a known technique used by attackers to obfuscate malicious scripts. The query then counts such events per device and filters for devices with more than 10 occurrences, indicating a high volume of encoded PowerShell commands that may signal malicious activity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Identify devices with outbound connections to malicious IPs
Why it's wrong here
The query does not look at network connections.
✗
Identify devices with PowerShell execution policy set to bypass
Why it's wrong here
The query does not filter by execution policy.
✗
Identify devices where a user deleted system files using cmd
Why it's wrong here
The query does not look for file deletions.
✓
Identify devices with high use of encoded commands, which may indicate malicious activity
Why this is correct
Encoded commands are often used to hide malicious intent.

Go deeper

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question