hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: An analyst is investigating a sophisticated…
An analyst is investigating a sophisticated attack involving a compromised device. The analyst has identified a malicious process that spawned multiple child processes. The analyst wants to create a custom detection rule in Microsoft 365 Defender that alerts when a specific parent process creates a child process that makes an outbound network connection to any IP not in the organization's internal range. Which KQL query and rule type should the analyst use?
⚠ Common exam trap
Watch out — candidates often think DeviceEvents contains all necessary telemetry or that a built-in rule already covers this specific scenario, but they must recognize that joining two distinct tables (DeviceProcessEvents and DeviceNetworkEvents) in an Advanced Hunting custom detection rule is required to correlate process creation with outbound network connections.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom detection rule (Advanced Hunting rule) with a query that joins DeviceProcessEvents and DeviceNetworkEvents, filtering for the parent process and external IP addresses
The analyst needs to correlate process creation events with network connection events across two separate tables (DeviceProcessEvents and DeviceNetworkEvents) in Advanced Hunting. A custom detection rule (Advanced Hunting rule) in Microsoft 365 Defender allows joining these tables to identify when a specific parent process spawns a child that makes an outbound connection to an external IP address, which is exactly the required detection logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a custom detection rule (Advanced Hunting rule) with a query that joins DeviceProcessEvents and DeviceNetworkEvents, filtering for the parent process and external IP addresses
Why this is correct
A custom detection rule in Microsoft 365 Defender is the correct choice because it is built on the Advanced Hunting schema, where you can join DeviceProcessEvents and DeviceNetworkEvents on DeviceId and Timestamp. By filtering for the specific parent process and external IP addresses, the query captures child processes making outbound connections, and the scheduled rule can generate alerts and trigger automated response actions.
- ✗
Create a scheduled rule in Sentinel and export the data from M365 Defender
Why it's wrong here
This option fails because it moves detection to an Azure Sentinel scheduled rule, requiring you to first configure the Microsoft 365 Defender data connector to export relevant events into the Sentinel Log Analytics workspace. The scenario explicitly requires creating a rule within Microsoft 365 Defender, not Sentinel, and exporting data is unnecessary when the same process and network events already reside in Defender's Advanced Hunting tables.
- ✗
Use a custom detection rule with DeviceEvents only
Why it's wrong here
Although DeviceEvents records security-relevant activities like driver loading and Windows event forwarding, it does not contain the structured network connection fields (localIP, remoteIP, remotePort) or the reliable process-creation hierarchy that are needed to correlate a parent process to child process outbound connections. Using DeviceEvents alone would force you to lose critical visibility found only in DeviceProcessEvents and DeviceNetworkEvents, so both dedicated tables must be joined in the custom detection rule.
- ✗
Use a Microsoft Defender for Endpoint custom detection rule (built-in) that already detects child process connections
Why it's wrong here
No built-in Microsoft Defender for Endpoint rule or out-of-the-box detection rule can generically identify 'child processes connecting to external IPs' because that pattern is fully scenario-specific, depending on the exact parent process and external addresses under investigation. A built-in rule cannot anticipate the particular process and IP pair described, so the analyst must author a custom Advanced Hunting rule with a join that targets this precise behavior.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.