MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
Your organization uses Microsoft Defender XDR. You are configuring a custom detection rule to detect a specific behavior: a user runs a PowerShell script that connects to a known malicious IP address. Which TWO advanced hunting tables should you use in your KQL query to detect this behavior?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceProcessEvents
To detect a user running a PowerShell script that connects to a known malicious IP address, you need to correlate process creation events (to capture the PowerShell script execution) with network connection events (to capture the outbound connection to the IP address). DeviceProcessEvents tracks process creation, including PowerShell.exe. DeviceNetworkEvents tracks network connections to remote IP addresses. Therefore, the correct tables are DeviceProcessEvents (A) and DeviceNetworkEvents (E).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeviceProcessEvents
Why this is correct
DeviceProcessEvents captures process creation, including PowerShell command lines, satisfying the requirement to detect script execution. However, it does not record network connections, so pairing it with DeviceNetworkEvents is necessary to identify the connection to the known malicious IP address.
- ✗
DeviceRegistryEvents
Why it's wrong here
DeviceRegistryEvents captures registry key and value modifications, which do not include PowerShell process execution or outbound connections to an IP address. It is tempting because malware frequently establishes persistence through registry run keys, and it would be correct if the behaviour involved suspicious registry changes rather than script execution and network traffic.
- ✗
DeviceLogonEvents
Why it's wrong here
DeviceLogonEvents records authentication activity such as interactive, remote and network logons, so it holds no process command line or remote IP connection data. It is tempting because a compromised account often precedes malicious execution, and it would be correct if the detection targeted anomalous sign-ins rather than a script contacting an external address.
- ✗
DeviceFileEvents
Why it's wrong here
DeviceFileEvents records file creation, modification and deletion, so it captures neither the PowerShell process execution nor the outbound network connection to the malicious IP. It is tempting because file telemetry can reveal a dropped script, and it would be correct if the behaviour involved suspicious file writes rather than process and network activity.
- ✓
DeviceNetworkEvents
Why this is correct
DeviceNetworkEvents records outbound network connections with remote IP and port, so it supplies the malicious IP match. Combined with process data, it satisfies the stem's requirement to detect a PowerShell script connecting to a known malicious address.
Go deeper
Related to this question
Learn chapter
Defender for Endpoint Deployment via Intune
Key term
Microsoft Defender XDR
Microsoft Defender XDR is a unified security platform that automatically correlates alerts from across an organization's endpoints, email, identities, and cloud apps to stop complex attacks.
Key term
XDR
XDR, or Extended Detection and Response, is a unified security platform that collects and correlates data across multiple security layers—endpoints, networks, servers, cloud workloads, and email—to improve threat detection and enable faster response.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.