hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst is investigating a…
A security analyst is investigating a sophisticated attack that involved multiple devices. The analyst needs to create a custom detection rule in Microsoft 365 Defender that triggers when a process with a specific SHA256 hash is executed on any device AFTER an attacker-controlled file is created on another device. Which approach should the analyst use to build this detection?
⚠ Common exam trap
Many exam-takers confuse incident creation rules (which only react to existing alerts) with custom detection rules (which can query raw telemetry), leading them to select Option B despite its inability to perform cross-table joins.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom detection rule using an advanced hunting query that joins DeviceFileEvents and DeviceProcessEvents, and schedule it in Microsoft 365 Defender.
The requirement is to correlate two distinct events (file creation on one device and process execution on another) across time and devices. An advanced hunting query in Microsoft 365 Defender can join DeviceFileEvents and DeviceProcessEvents tables using a common indicator (e.g., attacker-controlled file hash) and schedule the query as a custom detection rule. This is the only native Microsoft 365 Defender approach that supports multi-device, multi-event correlation with scheduled evaluation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a custom detection rule using an advanced hunting query that joins DeviceFileEvents and DeviceProcessEvents, and schedule it in Microsoft 365 Defender.
Why this is correct
A custom detection rule in Microsoft 365 Defender lets you run a KQL advanced hunting query on a schedule, joining DeviceFileEvents and DeviceProcessEvents to correlate file creation and process execution events across devices. This enables alerting on multi-stage attack sequences that individual alert rules might miss, with full flexibility to define thresholds, time windows, and affected device groups. Because the rule runs natively in the same environment that ingests the endpoint telemetry, it provides direct, low-latency detection without extra data transfer or licensing.
- ✗
Use the Microsoft 365 Defender incident creation rule to generate an incident when the behavior is observed.
Why it's wrong here
Incident creation rules in Microsoft 365 Defender are purely organizational automations that aggregate and prioritize existing alerts into incidents; they do not evaluate raw telemetry or contain custom detection logic. To use one, you must already have an alert firing from a built-in detection or a custom detection rule, since incident creation rules only act on alerts that have been generated by other sources. Therefore, they cannot create a new detection for an unobserved attack behavior.
- ✗
Use Microsoft Sentinel analytics rules with a data connector to Microsoft 365 Defender.
Why it's wrong here
Microsoft Sentinel analytics rules can indeed schedule KQL queries against mdatp tables once Microsoft 365 Defender data is ingested through the Microsoft 365 Defender connector, but this requires setting up a Sentinel workspace, paying for Log Analytics ingestion and analytics, and managing the connector. In contrast, a Microsoft 365 Defender custom detection rule runs directly on the endpoint telemetry already collected by the platform, avoiding the operational overhead and latency of a separate SIEM pipeline. For a pure Endpoint-Detection-and-Response (EDR) scenario focused on Device* event tables, the native custom detection rule is the intended and most direct choice.
- ✗
Use Microsoft Defender for Cloud's workload protection alerts.
Why it's wrong here
Microsoft Defender for Cloud provides protection for cloud workloads—such as virtual machines, storage accounts, SQL, and containers—through security posture management, vulnerability assessment, and workload-specific alerts. Its alert engine is based on cloud resource activity and security configurations, not on endpoint process-level telemetry like DeviceProcessEvents, nor does it have the capability to join DeviceFileEvents and DeviceProcessEvents across endpoints. It would be ineffective for detecting a cross-device attack pattern that hinges on local file and process behavior.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.