mediumMultiple Choice
SC-200 Practice Question: A security analyst in Microsoft 365 Defender is…
A security analyst in Microsoft 365 Defender is using advanced hunting to investigate a suspected data exfiltration. The analyst wants to find all outbound network connections from a specific device that occurred in the last hour, ordered by timestamp. Which table and KQL query should the analyst use?
⚠ Common exam trap
Many candidates confuse the purpose of different Microsoft 365 Defender tables, mistakenly selecting DeviceProcessEvents or DeviceFileEvents for network-related queries because they associate processes or files with data exfiltration, rather than recognizing that network connections are stored exclusively in DeviceNetworkEvents.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceNetworkEvents | where DeviceName == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc
The DeviceNetworkEvents table in Microsoft 365 Defender captures outbound network connections, including remote IP addresses and ports. The query filters for a specific device (DeviceName == 'deviceA'), limits results to the last hour using Timestamp > ago(1h), projects the relevant columns, and orders by Timestamp ascending to show the earliest connections first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeviceNetworkEvents | where DeviceName == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc
Why this is correct
Correct. DeviceNetworkEvents is Microsoft 365 Defender's advanced hunting table for actual network connection sessions, capturing fields such as Timestamp, DeviceName, RemoteIP, RemotePort, and direction. Filtering on DeviceName == 'deviceA' and Timestamp > ago(1h) isolates only that host's traffic over the last hour, and projecting then ordering by Timestamp ascending gives a precise chronological timeline of each connection for investigation.
- ✗
DeviceProcessEvents | where DeviceName == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc
Why it's wrong here
Wrong. DeviceProcessEvents records process creation events—process name, command line, parent process, etc.—but does not contain RemoteIP or RemotePort columns. Since the query projects those network fields, the advanced hunting query would fail with a Column not found error, and even if it ran, process creation events do not represent real network connections. This table is intended for hunting process launch activity, not connectivity.
- ✗
DeviceFileEvents | where DeviceName == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc
Why it's wrong here
Wrong. DeviceFileEvents is the schema for local file-system activities such as file creation, renamed, modified, or deleted; its columns include FolderPath, FileName, SHA256, and InitiatingProcess, but not RemoteIP or RemotePort. This query mistakenly tries to project network-specific fields from a table that only records host-level file events, so it cannot provide network connection data. To see which remote endpoints a device contacted, DeviceNetworkEvents is the appropriate table.
- ✗
EmailEvents | where SenderUpn == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc
Why it's wrong here
Wrong. EmailEvents is an email-focused table whose primary entity is mail messages, with columns like SenderUpn, RecipientEmailAddress, and EmailDirection, not device network sessions. Filtering SenderUpn == 'deviceA' is semantically invalid because deviceA is a device name, not a user principal name, and RemoteIP/RemotePort are not meaningful fields for email records. This query would not show the device's outbound network connections and would likely fail due to schema mismatch.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.