hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst is investigating an advanced…
A security analyst is investigating an advanced persistent threat (APT) campaign that involves lateral movement using RDP. The analyst wants to create a custom detection rule in Microsoft 365 Defender that triggers when a device remotely connects to another device via RDP (process: mstsc.exe) and, within 10 minutes, the remote device executes a suspicious script (e.g., PowerShell.exe with encoded command). Which KQL query pattern in advanced hunting should be used to correlate these events across devices?
⚠ Common exam trap
The trap here is that candidates often overlook the need to extract the remote device from the `mstsc.exe` command line and instead join on `DeviceName`, which would incorrectly correlate events on the same device rather than across devices, or they misorder the time window (checking after instead of before).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceProcessEvents | where FileName == 'mstsc.exe' | project SourceDevice = DeviceName, TimeGenerated, RemoteDevice = extract(remote device from command line) | join kind=inner (DeviceProcessEvents | where FileName == 'powershell.exe') on $left.RemoteDevice == $right.DeviceName and $left.TimeGenerated between ($right.TimeGenerated-10m .. $right.TimeGenerated)
It uses the `extract()` function to parse the remote device name from the `mstsc.exe` command line (e.g., `mstsc.exe /v:REMOTE_PC`), then performs an inner join with `DeviceProcessEvents` for `powershell.exe` on the condition that the remote device name matches and the `mstsc.exe` timestamp falls within a 10-minute window before the PowerShell execution. This precisely correlates the lateral movement (RDP connection) with the subsequent suspicious script execution on the target device, which is the required detection pattern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DeviceProcessEvents | where FileName == 'mstsc.exe' | join DeviceProcessEvents on DeviceName | where (Timestamp2 - Timestamp1) between (0m..10m) and FileName == 'powershell.exe'
Why it's wrong here
Joining on DeviceName from the same table would not match the remote device; also missing extraction of remote target.
- ✓
DeviceProcessEvents | where FileName == 'mstsc.exe' | project SourceDevice = DeviceName, TimeGenerated, RemoteDevice = extract(remote device from command line) | join kind=inner (DeviceProcessEvents | where FileName == 'powershell.exe') on $left.RemoteDevice == $right.DeviceName and $left.TimeGenerated between ($right.TimeGenerated-10m .. $right.TimeGenerated)
Why this is correct
This pattern extracts the remote device from the mstsc command line and joins with PowerShell events on the remote device within a 10-minute window after the RDP connection.
- ✗
DeviceProcessEvents | where FileName in~ ('mstsc.exe', 'powershell.exe') and TimeGenerated > ago(1h) | summarize makelist(DeviceName) by bin(TimeGenerated, 10m)
Why it's wrong here
This summary does not correlate RDP to script execution on the same or different device; it just lists devices per time bin.
- ✗
DeviceProcessEvents | where FileName == 'mstsc.exe' | extend RemoteDevice = extract(...,1, ProcessCommandLine) | join kind=inner (DeviceProcessEvents | where FileName == 'powershell.exe') on $left.RemoteDevice == $right.DeviceName and $left.TimeGenerated between ($right.TimeGenerated - 10m .. $right.TimeGenerated)
Why it's wrong here
The time window direction is reversed; the PowerShell should occur after mstsc.exe, not before.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is investigating an advanced persistent threat campaign that involves lateral movement using RDP. The analyst suspects that an attacker uses RDP from DeviceA to DeviceB, and then within a few minutes executes a malicious PowerShell script on DeviceB. The analyst wants to create a custom detection rule in Microsoft 365 Defender that triggers when this pattern occurs. Which KQL query pattern should be used to correlate these events across devices?
hard- ✓ A.Use a self-join: query DeviceProcessEvents for mstsc.exe, extract the target device (e.g., from command line), and then join with another query on DeviceProcessEvents for PowerShell on the target device where the time difference between the events is less than 10 minutes.
- B.Query DeviceNetworkEvents for RDP connections (port 3389) and then join with DeviceProcessEvents for PowerShell on the same device.
- C.Use the 'union' operator to combine all mstsc.exe and PowerShell events, then summarize by device and time.
- D.Query DeviceLogonEvents for RDP logon type and then join with DeviceProcessEvents for PowerShell on the same device.
Why A: It uses a self-join on DeviceProcessEvents to first detect the mstsc.exe process (RDP client) on DeviceA, extract the target device name from the command line, and then join with a second query on DeviceProcessEvents for PowerShell on DeviceB. The join condition includes a time difference of less than 10 minutes, which directly correlates the lateral movement (RDP) with the subsequent malicious script execution across devices, matching the described attack pattern.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.