hardMultiple Choice
SC-200 Practice Question: A security analyst is writing a Kusto Query…
A security analyst is writing a Kusto Query Language (KQL) advanced hunting query in Microsoft 365 Defender to detect lateral movement using Remote Desktop Protocol (RDP). Which table should the analyst join with the DeviceNetworkEvents table to identify processes initiating outgoing RDP connections?
⚠ Common exam trap
A common mix-up: candidates confuse DeviceLogonEvents (which logs RDP logon events) with the process initiation side, but the question asks for the table that identifies the process initiating the outgoing connection, not the authentication event on the target machine.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceProcessEvents
The DeviceNetworkEvents table logs network connections, including outgoing RDP traffic (port 3389). To identify which process initiated a specific outgoing RDP connection, you must join with the DeviceProcessEvents table on DeviceId and Timestamp (or ProcessId), because DeviceProcessEvents contains the process creation details (e.g., mstsc.exe) that launched the network connection. This join reveals the parent process responsible for the lateral movement attempt.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeviceProcessEvents
Why this is correct
DeviceProcessEvents is the correct table because it records every process creation event, including the process ID, parent process, command line, and execution timestamp. In a KQL hunt for RDP-initiated connections, you can join DeviceProcessEvents with DeviceNetworkEvents on ProcessId and filter for RemotePort 3389 to pinpoint the exact process that launched the RDP session. Without these process-creation details, you cannot establish the process-to-network correlation required to answer the question.
- ✗
DeviceLogonEvents
Why it's wrong here
DeviceLogonEvents captures authentication events, such as successful or failed logons, along with the user account, logon type, and source endpoint. This table reveals who logged into a machine and when, but it does not contain process creation details or process IDs needed to join with network connection events. Therefore, it cannot identify which process initiated an RDP connection; it would only tell you that a logon occurred, not the executing process behind the network traffic.
- ✗
DeviceFileEvents
Why it's wrong here
DeviceFileEvents tracks file system activity, including file creation, modification, and deletion, with file names, paths, and hashes. This table is unrelated to network sockets or process initiation—it contains no process-level network association and no RDP-specific connection metadata. Attempting to join DeviceFileEvents with DeviceNetworkEvents would yield no relevant process identifier, so it cannot be used to determine which process initiated an RDP connection.
- ✗
DeviceRegistryEvents
Why it's wrong here
DeviceRegistryEvents logs registry key and value modifications, reporting the registry path, modified value, and timestamp. While registry changes can sometimes be a side effect of RDP configuration updates, this table lacks both process creation event data and network connection information. There is no ProcessId or remote-port field to correlate with network events, making it entirely unsuitable for identifying the process that initiated an RDP connection.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.