SC-200 Perform threat hunting Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  IdentityLogonEvents

  Why it's wrong here

  IdentityLogonEvents is an advanced hunting table that records authentication and sign-in activity — such as successful or failed logon attempts, logon types, and authentication methods — from Active Directory and Microsoft Entra ID. It contains no process execution telemetry and no column for command-line arguments, so it cannot reveal what a PowerShell process actually executed. Even if the suspicious PowerShell session initiated an identity-related action, the command line itself would not appear here, making this table irrelevant for the hunt.

• ✓

  DeviceProcessEvents

  Why this is correct

  DeviceProcessEvents is the correct table because it captures process creation events on endpoints, and its ProcessCommandLine column stores the exact command line used to launch each process. This includes the PowerShell executable path, individual arguments, flags like -EncodedCommand or -ExecutionPolicy Bypass, and any obfuscated script text. The table also provides process ID, parent process, and initiating process command line, which are crucial for gaining full context on the suspicious PowerShell invocation during a threat hunt.

• ✗

  DeviceNetworkEvents

  Why it's wrong here

  DeviceNetworkEvents records network-level activity, including connections to IPs and ports, DNS resolutions, and connection directions, but it deliberately excludes process command-line arguments. While it might show that a PowerShell process initiated outbound traffic, it will not reveal the specific PowerShell script or the arguments that were executed. Investigators cannot use this table to retrieve the command line that triggered the threat, so it cannot satisfy the need to inspect the suspicious PowerShell command.

• ✗

  DeviceEvents

  Why it's wrong here

  DeviceEvents is a broad telemetry table in advanced hunting that captures on-device security events such as antivirus detections, file system changes, and registry modifications, but its schema does not include a ProcessCommandLine column. It may reference a PowerShell executable in a security alert, yet it lacks the granular detail of the actual command-line arguments passed to the process. Because the threat hunt specifically requires analyzing the PowerShell command line, DeviceEvents does not provide the necessary data depth, making DeviceProcessEvents the only suitable choice.

Go deeper

Related to this question