Manage security and threats by using Microsoft Defender XDR →hardMultiple ChoiceObjective-mapped

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Refer to the exhibit.

```kql
DeviceAlertEvents
| where Timestamp > ago(7d)
| where AlertTitle == "Suspicious process injection"
| summarize AlertCount = count() by DeviceName
| top 10 by AlertCount
```

You run the above KQL query in Microsoft Defender for Endpoint advanced hunting. What is the purpose of this query?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To identify the top 10 devices with the most suspicious process injection alerts

The query filters for alerts specifically related to suspicious process injection (e.g., AlertType == 'SuspiciousProcessInjection'), then groups by DeviceName and counts the alerts per device. It orders the results by count descending and returns the top 10 devices. This identifies the devices with the most suspicious process injection alerts, making Option A correct. Option B is incorrect because the query does not correlate with user activities. Option C is incorrect because it does not filter by severity but by a specific alert type. Option D is incorrect because it only counts a specific category of alerts, not all alert types.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
To identify the top 10 devices with the most suspicious process injection alerts
Why this is correct
Correct. The query filters alerts of type 'Suspicious process injection', groups by DeviceName, and returns the top 10 devices with the highest count.
✗
To correlate device alerts with user activities
Why it's wrong here
Incorrect. The query does not join or correlate with user activity data; it only uses alert information.
✗
To list all devices with high severity alerts
Why it's wrong here
Incorrect. The query does not filter by severity; it focuses on a specific alert type.
✗
To find the top 10 devices with the most alerts of any type
Why it's wrong here
Incorrect. The query specifically looks for 'Suspicious process injection' alerts, not all alert types.

Go deeper

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question