hardMultiple ChoiceObjective-mapped
Using DeviceFileEvents to Find File Creation Events
A security analyst is investigating a ransomware incident and needs to find all files that were written to a specific device within a 5-minute window before the ransomware process started. The analyst knows the device name and the ransomware process start time. Which advanced hunting table and KQL operator combination would be most efficient to find the file creation events?
Quick Answer
The answer is DeviceFileEvents with the where operator. This is the correct choice because DeviceFileEvents is the advanced hunting table specifically designed to capture file creation, modification, and deletion events on endpoints, making it the ideal source for identifying files written during a ransomware incident. By applying the where operator to filter on the device name and a timestamp range—such as the five minutes preceding the ransomware process start time—you efficiently narrow the results to only the relevant file creation events without scanning unrelated data. On the SC-200 exam, this scenario tests your ability to match the right hunting table to the event type and to use time-based filters effectively, a common trap being the misuse of the project or extend operators instead of where for row-level filtering. A solid memory tip is to think of DeviceFileEvents as your “file activity diary” and where as your “time-and-place bookmark”—together, they pinpoint exactly what changed and when.
⚠ Common exam trap
Watch out — candidates often confuse DeviceProcessEvents (process creation) with file creation events, or they think a `join` is needed to correlate process start time with file events, when a simple `where` on DeviceFileEvents is sufficient and more efficient.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceFileEvents with where
DeviceFileEvents is the correct table because it specifically captures file creation, modification, and deletion events on devices. Using the `where` operator to filter by device name and a timestamp range (5 minutes before the ransomware process start time) is the most efficient way to retrieve the exact file creation events needed for the investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeviceFileEvents with where
Why this is correct
DeviceFileEvents contains file creation events; filtering with 'where' on device and time is the simplest approach.
- ✗
DeviceProcessEvents with join
Why it's wrong here
DeviceProcessEvents tracks processes, not files; joining would be inefficient and indirect.
- ✗
DeviceEvents with where
Why it's wrong here
DeviceEvents includes various events but not a specialized file creation log; it may miss information.
- ✗
DeviceImageLoadEvents with where
Why it's wrong here
DeviceImageLoadEvents logs image (DLL) loads, not file writes.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is investigating a malware outbreak and needs to find all devices where a specific malicious file with a known SHA1 hash has been observed in the last 24 hours. Which Advanced Hunting table in Microsoft 365 Defender should be the primary source for this query?
easy- ✓ A.DeviceFileEvents
- B.EmailAttachmentInfo
- C.DeviceProcessEvents
- D.DeviceNetworkEvents
Why A: DeviceFileEvents is the correct table because it specifically records file creation, modification, and deletion events on endpoints, including the SHA1 hash of files. To find all devices where a specific malicious file with a known SHA1 hash has been observed, this table provides the direct file-level telemetry needed for the query.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.