mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: Advanced hunting uses Kusto Query Language (KQL).
A security analyst is investigating a potential malware outbreak using Microsoft 365 Defender advanced hunting. The analyst wants to find all devices where a file with a specific SHA256 hash was first created and then later deleted, which may indicate a cleanup attempt. Which query pattern on the DeviceFileEvents table is appropriate?
⚠ Common exam trap
Test-takers frequently confuse the column name `SHA256` with `FileHash` (which does not exist in DeviceFileEvents) or forget to filter by the specific hash before summarizing, leading to false positives from unrelated file operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceFileEvents | where SHA256 == "<hash>" | summarize Actions = make_set(ActionType) by DeviceId | where Actions has_all ("FileCreated", "FileDeleted")
It first filters by the specific SHA256 hash, then uses `make_set(ActionType)` to collect all actions per device, and finally checks that both 'FileCreated' and 'FileDeleted' appear in the set. This precisely identifies devices where the file was both created and later deleted, indicating a potential cleanup attempt.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeviceFileEvents | where SHA256 == "<hash>" | summarize Actions = make_set(ActionType) by DeviceId | where Actions has_all ("FileCreated", "FileDeleted")
Why this is correct
This query correctly identifies devices by first filtering DeviceFileEvents to only rows where SHA256 equals the known malicious hash. The summarize operator then groups by DeviceId and uses make_set(ActionType) to build an array of every file action observed for that file on each device. The subsequent where clause with has_all ensures that both 'FileCreated' and 'FileDeleted' appear in that array, verifying the file was created and later deleted on the same device. This precisely matches the requirement to find devices exhibiting both lifecycle events for the same file hash.
- ✗
DeviceFileEvents | where SHA256 == "<hash>" and ActionType == "FileDeleted" | project DeviceId
Why it's wrong here
This query filters directly to only 'FileDeleted' events for the specified SHA256 hash, then projects DeviceId without any grouping. Consequently, it can only tell you which devices deleted the file, never whether they also created it. Even if you added a distinct or summarize, it lacks the 'FileCreated' condition, so devices that only deleted a file that was placed by other means would still appear. It fails the requirement of confirming both creation and deletion occurred on the same device.
- ✗
DeviceFileEvents | where FileHash == "<hash>" | summarize Actions = make_set(ActionType) by DeviceId | where Actions has "FileCreated"
Why it's wrong here
This query has two distinct flaws. First, it references FileHash, but DeviceFileEvents does not expose that column; the correct hash-specific column is SHA256, so this would likely generate a query error or match nothing. Second, even after grouping by DeviceId and checking that the action set contains 'FileCreated', it never verifies 'FileDeleted' as well. The has operator checks for a single element, not all required elements. Thus, it would include devices where the file was only created, which does not satisfy the investigation's condition.
- ✗
DeviceFileEvents | summarize by DeviceId, ActionType | where ActionType in ("FileCreated", "FileDeleted")
Why it's wrong here
This query completely omits any filtering by the specific SHA256 hash, so it aggregates file actions for all files across all devices. The summarize by DeviceId, ActionType then produces a flat table with one row per device/action pair, and the where clause retains any row with either 'FileCreated' or 'FileDeleted'. This yields devices that have any created or deleted file, regardless of whether they ever touched the malware hash, and the lack of cross-row aggregation means no device is checked for having both actions. It is far too broad and fails on both the hash filter and the both-actions requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.