Manage security and threats by using Microsoft Defender XDR →easyMultiple ChoiceObjective-mapped

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Refer to the exhibit.
```kusto
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName == "powershell.exe"
| where ProcessCommandLine has "-EncodedCommand"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| take 10
```

You run the KQL query shown in the exhibit in Microsoft Defender XDR advanced hunting. What is the primary purpose of this query?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Detect potentially malicious PowerShell commands that are obfuscated

The query filters for powershell.exe processes with an encoded command, which is commonly used to obfuscate malicious commands. Option A is wrong because the query does not filter for specific users. Option C is wrong because the query does not filter by device. Option D is wrong because the query does not filter by time other than the last 7 days.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Identify all PowerShell activity from a specific user
Why it's wrong here
The query is built around command-line text matching for encoded or obfuscated PowerShell parameters, not around user identity. It contains no filter on AccountName, UserId, or InitiatingProcessAccountName, so it cannot isolate a single user's activity. Moreover, ordinary PowerShell actions from a user would not appear unless they specifically include the encoded-command indicator, so it fails the 'all activity' goal.
✓
Detect potentially malicious PowerShell commands that are obfuscated
Why this is correct
This query deliberately searches for PowerShell processes launched with the -EncodedCommand parameter, which causes the payload to be passed as a Base64 string. Encoded commands are a hallmark of obfuscation because attackers use them to hide malicious code from casual log inspection and signature-based detection. The presence of an encoded PowerShell command is therefore a valid trigger point for investigating potentially malicious behavior.
✗
Find PowerShell processes running on a specific device
Why it's wrong here
The query has no DeviceName, DeviceId, or similar device-scoped predicate in its logic. It returns every PowerShell process event that matches the encoded-command condition across all machines reporting into Microsoft Defender unless the UI applies a device filter externally. As a result, it is not designed to find processes on one specific device; doing so would require adding a device identifier to the KQL statement.
✗
List all PowerShell executions in the last 7 days
Why it's wrong here
Because the query specifically filters for PowerShell command lines containing an encoded command parameter, it omits the vast majority of PowerShell executions that use normal, human-readable arguments. Even if a time range is applied in the portal, the result is a narrow subset of all PowerShell activity rather than a complete execution log. A true last-7-days list would need to remove the encoded-command filter and aggregate on FileName == 'powershell.exe' or 'pwsh.exe'.

Go deeper

1 more way this is tested on MS-102

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. You run the KQL query in advanced hunting. What is the primary purpose of this query?

hard

A.Identify devices with outbound connections to malicious IPs
B.Identify devices with PowerShell execution policy set to bypass
C.Identify devices where a user deleted system files using cmd
✓ D.Identify devices with high use of encoded commands, which may indicate malicious activity

Why D: The KQL query filters for DeviceProcessEvents where the command line contains 'powershell' and the process command line includes '-EncodedCommand', which is a known technique used by attackers to obfuscate malicious scripts. The query then counts such events per device and filters for devices with more than 10 occurrences, indicating a high volume of encoded PowerShell commands that may signal malicious activity.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on MS-102