easyMultiple Choice
SC-200 Practice Question: A security analyst is using Microsoft 365…
A security analyst is using Microsoft 365 Defender advanced hunting to investigate a ransomware incident. The analyst wants to find all processes that were created with a specific parent process ID. Which column in the DeviceProcessEvents table should the analyst use to filter the parent process?
⚠ Common exam trap
Many exam-takers confuse InitiatingProcessId (used in cross-table joins for email or alert context) with ParentProcessId, which is the direct column for parent-child process relationships in DeviceProcessEvents.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ParentProcessId
The ParentProcessId column in the DeviceProcessEvents table stores the process ID (PID) of the parent process that created a given process. By filtering on this column, the analyst can identify all child processes spawned by a specific parent, which is critical for tracing ransomware execution chains in advanced hunting queries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ProcessId
Why it's wrong here
ProcessId is the unique numeric identifier assigned to the newly created process itself, not to the process that spawned it. In the DeviceProcessEvents table, this column describes the child process's identity, so filtering on it would return only that specific process rather than its parent. To follow the parent-child relationship, you must read the ParentProcessId column, which captures the creator's process ID from the same event.
- ✓
ParentProcessId
Why this is correct
ParentProcessId is the authoritative column for direct process lineage because it stores the process ID of the process that created the current process. When a process creation event is logged, this field is populated with the parent process's unique identifier, enabling an exact one-level relationship in the process tree. Using it lets you join back to the same DeviceProcessEvents table to retrieve the parent process's command line and metadata.
- ✗
InitiatingProcessId
Why it's wrong here
InitiatingProcessId identifies the process that initiated the broader action, which is not always the immediate parent. For example, if a scheduled task or a service launches a child process, the initiating process may be the Task Scheduler or Service Control Manager, while the direct parent is the intermediate process that actually spawned the child. Because the question asks specifically for the parent process, ParentProcessId is the precise column; InitiatingProcessId is more useful for tracing the original actor in a multi-step attack chain.
- ✗
LogonId
Why it's wrong here
LogonId is a security session identifier that ties a process to a user's logon session, not to the process that created it. Each interactive or remote logon gets a unique LogonId, and all processes running under that session share it, making it useful for grouping processes by user context. It contains no reference to the creator process, so it cannot be used to determine the parent-child relationship in a process tree.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.