SC-200 Respond to security incidents Practice Question
Exhibit
Refer to the exhibit.
```json
// Microsoft Defender XDR advanced hunting query
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe")
| where ProcessCommandLine contains "-enc"
| project Timestamp, DeviceName, FileName, ProcessCommandLine
| sort by Timestamp desc
```An analyst runs this advanced hunting query to investigate suspicious command-line activity. Which type of activity is this query most likely detecting?
⚠ Common exam trap
SC-200 often tests the ability to interpret KQL queries and map them to attack techniques, so candidates might confuse encoded command execution with other attack types like exfiltration or privilege escalation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Execution of obfuscated scripts via encoded commands
The query likely searches for command lines containing encoded or obfuscated script indicators, such as 'powershell -enc' or Base64-encoded commands, which are common in malicious script execution. Advanced hunting in Microsoft 365 Defender uses Kusto Query Language (KQL) to query device process events. Detecting encoded commands is a typical technique to identify obfuscated scripts that evade detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Execution of obfuscated scripts via encoded commands
Why this is correct
Encoded commands, typically Base64 strings passed to PowerShell or command shells, are the signature this hunting query targets. Decoding and inspecting those command lines reveals obfuscated script execution, matching the query's focus on suspicious command-line activity.
- ✗
Data exfiltration to external IPs
Why it's wrong here
Advanced hunting queries filtering command-line telemetry detect process execution patterns, not network flows to external addresses; exfiltration requires device network events or firewall logs. It is tempting because suspicious command lines often precede exfiltration, but the query's data source is the wrong axis for confirming outbound transfers.
- ✗
Privilege escalation attempts
Why it's wrong here
Privilege escalation typically appears as token manipulation, runas, or UAC-bypass patterns, not the process-and-command-line fields this query projects. It is tempting because advanced hunting is commonly used to surface elevation attempts, and a query filtering command-line content would be the right choice when hunting for encoded PowerShell or credential-dumping tools instead.
- ✗
Port scanning activity
Why it's wrong here
Port scanning produces network connection events, not the process command-line data this query projects from DeviceProcessEvents. It is tempting because scanning often accompanies intrusions, and queries joining DeviceNetworkEvents to DeviceProcessEvents would surface it — but that requires network telemetry, which this query never references.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.