How to Detect Encoded PowerShell Commands in Microsoft Defender XDR Custom Detection
This SC-200 practice question tests your understanding of manage a security operations environment. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: kQL query tuning. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
```kusto
DeviceProcessEvents
| where Timestamp >= ago(1h)
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-enc" or ProcessCommandLine contains "-e"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
```
The exhibit shows a KQL query used in a Microsoft 365 Defender custom detection rule. The query is intended to detect encoded PowerShell commands executed in the last hour. However, the detection rule is not generating any alerts even though the SOC knows that encoded PowerShell commands are being executed. Which modification would most likely fix the detection rule?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Exhibit
Refer to the exhibit.
```kusto
DeviceProcessEvents
| where Timestamp >= ago(1h)
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-enc" or ProcessCommandLine contains "-e"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
```
A
Change `contains` to `has` for better performance and accuracy.
Why wrong: `has` is more accurate but does not fix the missing detection; the main issue is the missing parameter.
B
Add a condition to also look for `-EncodedCommand` in the command line.
The `-enc` flag is an alias for `-EncodedCommand`, but the query should explicitly check for `-EncodedCommand` to ensure detection of all variations.
C
Modify the query to use `project-away` instead of `project`.
Why wrong: `project-away` is for removing columns; it would not fix detection.
D
Replace `FileName == "powershell.exe"` with `InitiatingProcessFileName == "powershell.exe"`.
Why wrong: `FileName` is correct for the process itself; `InitiatingProcessFileName` would refer to the parent process.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a condition to also look for `-EncodedCommand` in the command line.
The query uses `contains '-e'` which is too broad and matches many non-encoded commands. Adding a condition to explicitly check for `-EncodedCommand` in the command line narrows the detection to actual encoded PowerShell commands, which is the most likely fix for false negatives. Options A, C, and D either address performance issues or irrelevant filtering that would not specifically fix the detection of encoded commands.
Key principle: KQL query tuning
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Change `contains` to `has` for better performance and accuracy.
Why it's wrong here
`has` is more accurate but does not fix the missing detection; the main issue is the missing parameter.
✓
Add a condition to also look for `-EncodedCommand` in the command line.
Why this is correct
The `-enc` flag is an alias for `-EncodedCommand`, but the query should explicitly check for `-EncodedCommand` to ensure detection of all variations.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
KQL query tuning
✗
Modify the query to use `project-away` instead of `project`.
Why it's wrong here
`project-away` is for removing columns; it would not fix detection.
✗
Replace `FileName == "powershell.exe"` with `InitiatingProcessFileName == "powershell.exe"`.
Why it's wrong here
`FileName` is correct for the process itself; `InitiatingProcessFileName` would refer to the parent process.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Candidates often think that using `contains` with a partial string is sufficient, but encoded commands use the specific parameter `-EncodedCommand`. The trap is that a query with `contains '-e'` will miss commands using the full parameter name.
Detailed technical explanation
How to think about this question
Treat this as a scenario question. Identify the problem, the constraint, and the best action. Then compare each option against those facts.
KKey Concepts to Remember
KQL query tuning
Encoded PowerShell commands
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
KQL query tuning
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. KQL query tuning Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Manage a security operations environment — This question tests Manage a security operations environment — KQL query tuning.
What is the correct answer to this question?
The correct answer is: Add a condition to also look for `-EncodedCommand` in the command line. — The query uses `contains '-e'` which is too broad and matches many non-encoded commands. Adding a condition to explicitly check for `-EncodedCommand` in the command line narrows the detection to actual encoded PowerShell commands, which is the most likely fix for false negatives. Options A, C, and D either address performance issues or irrelevant filtering that would not specifically fix the detection of encoded commands.
What should I do if I get this SC-200 question wrong?
Review kQL query tuning, then practise related SC-200 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
KQL query tuning
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.