easyMultiple Choice
SC-200 Practice Question: A security analyst is investigating a suspicious…
A security analyst is investigating a suspicious process on an endpoint and wants to see all changes made to the Windows Registry by that process. Which advanced hunting table should the analyst query to find registry modification events associated with the process?
⚠ Common exam trap
Test-takers frequently confuse DeviceEvents (which sounds generic enough to include registry events) with the dedicated DeviceRegistryEvents table, but DeviceEvents only contains security alerts and not raw registry modification telemetry.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceRegistryEvents
DeviceRegistryEvents is the correct table because it specifically captures Windows Registry modification events, including create, modify, and delete operations. For a process-based investigation, this table includes the InitiatingProcessId and InitiatingProcessFileName columns, allowing the analyst to filter by the suspicious process's PID or name to see all registry changes it made.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DeviceProcessEvents
Why it's wrong here
DeviceProcessEvents only captures process creation and termination events, including the process name, command line, and parent process. A registry modification does not generate a process lifecycle event, so the suspicious process's registry change will not be recorded in this table. The initiating process information via DeviceProcessEvents is useful for correlation, but the actual registry change must be found in DeviceRegistryEvents.
- ✓
DeviceRegistryEvents
Why this is correct
DeviceRegistryEvents is the correct answer because it is the dedicated advanced hunting table for registry changes, recording event types such as RegistryValueSet, RegistryKeyDeleted, and RegistryValueDeleted. Each event includes the affected RegistryKey, RegistryValueName, RegistryValueData, and the initiating process with its command line. This schema allows the analyst to directly link a specific registry modification to the process that performed it, which is the core requirement of this investigation.
- ✗
DeviceEvents
Why it's wrong here
DeviceEvents is a catch-all table containing various system-level events that are not specifically categorized, but it does not have a structured schema for registry activity. While it may include some events related to the process or system, Microsoft 365 Defender stores registry modifications in DeviceRegistryEvents with dedicated fields for key, value, and action type. Relying on DeviceEvents would force an analyst to search for unstructured event messages and still miss the complete registry-change context.
- ✗
DeviceFileEvents
Why it's wrong here
DeviceFileEvents records file system operations such as file creation, modification, renaming, and deletion, including the file path and the responsible process. Registry keys and values are stored in the registry hive, not as files on disk, so modifying a registry value does not generate a file event. Even if a process writes a file alongside a registry change, the registry change itself will appear only in DeviceRegistryEvents, not in DeviceFileEvents.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.