mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst is building a custom detection…
A security analyst is building a custom detection rule in Microsoft 365 Defender to identify ransomware activity. The rule should trigger when files with specific extensions (e.g., .encrypted, .locked) are created on multiple devices within a short time frame, suggesting a widespread attack. Which combination of advanced hunting tables should be used to obtain both file creation events and device information?
⚠ Common exam trap
Many candidates confuse file creation events with process creation events (DeviceProcessEvents) or network events (DeviceNetworkEvents), overlooking that only DeviceFileEvents directly captures the file extension data needed for ransomware detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceFileEvents and DeviceInfo
DeviceFileEvents captures file creation events, including the specific extensions like .encrypted and .locked, while DeviceInfo provides device metadata such as device name, OS platform, and device group. Joining these tables on DeviceId allows the analyst to correlate file creation events across multiple devices, enabling detection of widespread ransomware activity within a short time frame.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeviceFileEvents and DeviceInfo
Why this is correct
Correct. DeviceFileEvents contains file creation (ActionType 'FileCreated') details including SHA256, file name, and folder path. Joining with DeviceInfo provides device metadata like device name and OS. This combination directly supports the requirement.
- ✗
DeviceProcessEvents and DeviceInfo
Why it's wrong here
`DeviceProcessEvents` primarily logs process creation, termination, and network connections, not file creation events, which are essential for identifying ransomware based on new encrypted files. Therefore, it fails to meet the core requirement of tracking specific file extensions being created. This combination is tempting because `DeviceInfo` provides crucial context, and `DeviceProcessEvents` is vital for detecting suspicious process execution or network communication, making it suitable for investigating other forms of malware activity.
- ✗
DeviceFileEvents and DeviceNetworkEvents
Why it's wrong here
DeviceNetworkEvents records network connections. While useful for lateral movement detection, it is not needed to identify the creation of encrypted files across devices. The requirement is about files, not network.
- ✗
DeviceFileEvents and DeviceLogonEvents
Why it's wrong here
DeviceLogonEvents contains logon activity (success/failure, account). This is not relevant to identifying file creation events across devices. The rule does not require logon information.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.