The answer is the DeviceRegistryEvents table. This is correct because DeviceRegistryEvents is the dedicated advanced hunting table in Microsoft 365 Defender that captures all Windows Registry modification events, including create, modify, and delete operations, and it exposes the InitiatingProcessId and InitiatingProcessFileName columns. These columns allow an analyst to directly filter by a suspicious process’s PID or name to find every registry change that process made, making it the precise tool for this investigation. On the SC-200 exam, this tests your ability to map a specific investigative scenario to the correct advanced hunting schema, often appearing as a straightforward table-selection question where common traps include confusing it with DeviceProcessEvents or DeviceFileEvents. A useful memory tip: think of “Registry” in the table name as your clue—if the question asks about registry changes, the answer always starts with “DeviceRegistry.”
SC-200 Mitigate threats using Microsoft Defender XDR Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: deviceRegistryEvents captures all registry key and value modifications.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is investigating a suspicious process on an endpoint and wants to see all changes made to the Windows Registry by that process. Which advanced hunting table should the analyst query to find registry modification events associated with the process?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceRegistryEvents
DeviceRegistryEvents is the correct table because it specifically captures Windows Registry modification events, including create, modify, and delete operations. For a process-based investigation, this table includes the InitiatingProcessId and InitiatingProcessFileName columns, allowing the analyst to filter by the suspicious process's PID or name to see all registry changes it made.
Key principle: DeviceRegistryEvents captures all registry key and value modifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
DeviceProcessEvents
Why it's wrong here
DeviceProcessEvents records process creations and terminations, not registry modifications.
✓
DeviceRegistryEvents
Why this is correct
DeviceRegistryEvents is the dedicated table for registry events and includes the process that made the change.
Related concept
DeviceRegistryEvents captures all registry key and value modifications.
✗
DeviceEvents
Why it's wrong here
DeviceEvents may contain miscellaneous system events, but the dedicated table for registry is DeviceRegistryEvents.
✗
DeviceFileEvents
Why it's wrong here
DeviceFileEvents covers file operations like create, modify, delete; not registry changes.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse DeviceEvents (which sounds generic enough to include registry events) with the dedicated DeviceRegistryEvents table, but DeviceEvents only contains security alerts and not raw registry modification telemetry.
Detailed technical explanation
How to think about this question
Under the hood, DeviceRegistryEvents is populated by the Microsoft Defender for Endpoint sensor using Windows kernel callbacks (e.g., CmRegisterCallback) to intercept registry operations at the kernel level. This table includes columns such as RegistryKey, RegistryValueName, RegistryValueData, and ActionType (e.g., 'RegistryValueSet' or 'RegistryKeyDeleted'), enabling precise forensic reconstruction of registry persistence mechanisms like Run keys or service configuration changes.
KKey Concepts to Remember
DeviceRegistryEvents captures all registry key and value modifications.
It includes details like InitiatingProcessFileName to link events to processes.
This table is crucial for investigating malware persistence mechanisms.
Registry events include creation, modification, and deletion of keys/values.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
DeviceRegistryEvents captures all registry key and value modifications.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Review deviceRegistryEvents captures all registry key and value modifications., then practise related SC-200 questions on the same topic to reinforce the concept.
Mitigate threats using Microsoft Defender XDR — This question tests Mitigate threats using Microsoft Defender XDR — DeviceRegistryEvents captures all registry key and value modifications..
What is the correct answer to this question?
The correct answer is: DeviceRegistryEvents — DeviceRegistryEvents is the correct table because it specifically captures Windows Registry modification events, including create, modify, and delete operations. For a process-based investigation, this table includes the InitiatingProcessId and InitiatingProcessFileName columns, allowing the analyst to filter by the suspicious process's PID or name to see all registry changes it made.
What should I do if I get this SC-200 question wrong?
Review deviceRegistryEvents captures all registry key and value modifications., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
DeviceRegistryEvents captures all registry key and value modifications.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.