Manage security and threats by using Microsoft Defender XDR →hardMultiple Choice

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Refer to the exhibit.
```kql
DeviceProcessEvents
| where Timestamp between (datetime(2024-01-01) .. datetime(2024-01-02))
| where FileName == "powershell.exe"
| where ProcessCommandLine has "-EncodedCommand"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
```

You are hunting for malicious activity in Microsoft 365 Defender. The exhibit shows a KQL query. What is the query searching for?

⚠ Common exam trap

MS-102 often tests whether candidates can distinguish between detection logic based on command-line content versus process lineage or network behavior, causing them to pick the parent-process or download-origin option.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

PowerShell processes with encoded command line arguments

The KQL query filters PowerShell process creation events where the command line contains encoded command indicators such as '-enc', '-EncodedCommand', or Base64-looking strings. This pattern is a classic detection for obfuscated PowerShell used by attackers to hide malicious scripts from casual inspection and simple string-based defenses.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
PowerShell processes with standard command line arguments
Why it's wrong here
The query does not inspect command-line content or match argument patterns. Command-line analysis requires filtering the ProcessCommandLine column for specific flags or encoded strings. This option would be correct if the exhibit projected or searched ProcessCommandLine for standard switches such as -Command or -EncodedCommand.
✗
Processes that created PowerShell processes
Why it's wrong here
The query filters on a process-initiating-parent relationship, not on which binary was launched. Process creation events record InitiatingProcessFileName and FileName as separate columns; the exhibit selects on the child process name. This option would be right if the query joined or filtered on the parent process field to trace PowerShell spawning children.
✗
PowerShell processes that were downloaded from the internet
Why it's wrong here
No field in the query references download origin, URL, or network provenance. Determining internet download requires correlating DeviceNetworkEvents or file-origin metadata with the process. This option would fit a query joining network connection events to the process, not one filtering process creation records alone.
✓
PowerShell processes with encoded command line arguments
Why this is correct
The query filters process command lines for encoded arguments, a common obfuscation technique where Base64 hides malicious PowerShell payloads. Matching on encoded command line indicators surfaces this behaviour, satisfying the stem's hunt for malicious activity in Microsoft 365 Defender.

Go deeper

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question