Question 1,184 of 209
hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst is using Microsoft 365…
A security analyst is using Microsoft 365 Defender advanced hunting to investigate potential lateral movement. The analyst has identified a compromised device (DeviceA) and wants to find all other devices that initiated a remote desktop connection from DeviceA to other devices in the last 24 hours. Which table and query approach should the analyst use?
⚠ Common exam trap
Candidates often confuse 'initiating an RDP connection' (network-level outbound connection) with 'successful RDP logon' (authentication event on the target), leading them to incorrectly choose DeviceLogonEvents with LogonType 10 instead of DeviceNetworkEvents.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Query DeviceNetworkEvents for events from DeviceA with RemotePort 3389, then join with DeviceInfo to get target device names.
DeviceNetworkEvents logs network connections, including outbound RDP traffic (port 3389). By filtering for events from DeviceA with RemotePort 3389, the analyst captures all RDP connections initiated by DeviceA. Joining with DeviceInfo resolves the target IP addresses to device names, providing a complete list of devices that received an RDP connection from DeviceA in the last 24 hours.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Query DeviceNetworkEvents for events from DeviceA with RemotePort 3389, then join with DeviceInfo to get target device names.
Why this is correct
DeviceNetworkEvents in Microsoft 365 Defender Advanced Hunting records network connection attempts by managed devices, including the destination IP and port (RemotePort) and the initiating device ID. Filtering for DeviceA and RemotePort 3389 isolates RDP traffic leaving that device, and joining to DeviceInfo on RemoteIP resolves the target device name for each inbound connection. This directly answers which devices DeviceA connected to via RDP.
- ✗
Query DeviceLogonEvents for LogonType 10 (RemoteInteractive), filtering by initiating device.
Why it's wrong here
DeviceLogonEvents logs successful interactive logons, but the initiating device is not the device where the connection came from; it is the target device. This query would show who logged into DeviceA, not connections from DeviceA.
- ✗
Query IdentityLogonEvents to find logons associated with DeviceA.
Why it's wrong here
IdentityLogonEvents captures cloud-based authentication events for Microsoft Entra ID (Azure AD), such as sign-ins to apps and services, not outbound network connections or RDP sessions. A logon associated with DeviceA would reflect the identity used to authenticate, not the network destination or port, and it cannot reveal which target devices DeviceA connected to over port 3389. Thus it is the wrong table for this investigation.
- ✗
Query EmailEvents to find emails sent from DeviceA that contain RDP configuration files.
Why it's wrong here
EmailEvents in Advanced Hunting contains metadata about email messages handled by Microsoft 365 Defender (delivery, spoofing, phishing verdicts), not the network traffic generated by a device. Searching for emails sent from DeviceA is conceptually wrong because devices do not appear as senders in EmailEvents—those are mailbox and tenant mail flow events—and even if a message contained RDP configuration files, it proves nothing about actual RDP connections from that device. This option fails to provide any destination IP or port evidence.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.