mediumMultiple Choice
SC-200 Practice Question: A security analyst is building a custom detection…
A security analyst is building a custom detection rule in Microsoft 365 Defender to identify ransomware activity. The rule should trigger when files with specific extensions (e.g., .encrypted, .locked) are created on multiple devices within a short time frame, suggesting a widespread attack. Which combination of advanced hunting tables should be used to obtain both file creation events and device information?
⚠ Common exam trap
Many candidates confuse file creation events with process creation events (DeviceProcessEvents) or network events (DeviceNetworkEvents), overlooking that only DeviceFileEvents directly captures the file extension data needed for ransomware detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceFileEvents and DeviceInfo
DeviceFileEvents captures file creation events, including the specific extensions like .encrypted and .locked, while DeviceInfo provides device metadata such as device name, OS platform, and device group. Joining these tables on DeviceId allows the analyst to correlate file creation events across multiple devices, enabling detection of widespread ransomware activity within a short time frame.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeviceFileEvents and DeviceInfo
Why this is correct
DeviceFileEvents supplies the file creation records, including the extension and timestamp, while DeviceInfo supplies the device metadata needed to correlate activity across machines. Joining them on DeviceId satisfies the stem's requirement to detect widespread ransomware file encryption across multiple devices.
- ✗
DeviceProcessEvents and DeviceInfo
Why it's wrong here
`DeviceProcessEvents` primarily logs process creation, termination, and network connections, not file creation events, which are essential for identifying ransomware based on new encrypted files. Therefore, it fails to meet the core requirement of tracking specific file extensions being created. This combination is tempting because `DeviceInfo` provides crucial context, and `DeviceProcessEvents` is vital for detecting suspicious process execution or network communication, making it suitable for investigating other forms of malware activity.
- ✗
DeviceFileEvents and DeviceNetworkEvents
Why it's wrong here
DeviceNetworkEvents records connection metadata, not device properties such as machine group or onboarding status. It is tempting because network telemetry helps trace ransomware command-and-control, yet correlating file creation across devices needs DeviceInfo joined with DeviceFileEvents.
- ✗
DeviceFileEvents and DeviceLogonEvents
Why it's wrong here
DeviceLogonEvents supplies sign-in and logon data, not the device inventory attributes the rule needs to correlate file creation across machines. It is tempting because logon telemetry supports lateral-movement detections, but here DeviceInfo is required alongside DeviceFileEvents.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.