SC-200 Perform threat hunting Practice Question
During a threat hunt, you discover that a PowerShell script executed on multiple servers and established outbound connections to an external IP address. Which data source should you query in Microsoft Defender XDR to identify the specific command-line arguments used?
⚠ Common exam trap
The trap is confusing process events with network events. Candidates might pick DeviceNetworkEvents because the question mentions outbound connections, but the question asks for command-line arguments, which are in process events. DeviceEvents is a distractor because it's a general table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceProcessEvents
DeviceProcessEvents in Microsoft Defender XDR contains detailed information about process creation, including the command-line arguments used when a process was started. Querying this table will reveal the specific arguments passed to the PowerShell script. This is the correct data source for command-line details.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DeviceEvents
Why it's wrong here
DeviceEvents is a broad, multi-action table; PowerShell command-line arguments are captured specifically in DeviceProcessEvents, which records ProcessCommandLine on process creation. DeviceEvents tempts because it does contain some script and process-related action types, but querying it for command lines is indirect and incomplete.
- ✗
DeviceImageLoadEvents
Why it's wrong here
DeviceImageLoadEvents logs DLL and module loads into processes, which never contains the script's command-line arguments. It tempts because malicious PowerShell often loads suspicious modules, so image-load activity can corroborate execution, but the arguments themselves live in process-creation telemetry.
- ✓
DeviceProcessEvents
Why this is correct
DeviceProcessEvents stores process creation telemetry, including the full command line and arguments for each executed process, so querying it reveals the exact PowerShell parameters used. Network connection tables record destination IPs but not the command-line arguments that launched the script.
- ✗
DeviceNetworkEvents
Why it's wrong here
DeviceNetworkEvents records connection metadata such as remote IP, port and initiating process, not the process command line. It tempts because the outbound connection is the visible symptom, and this table would confirm the external IP, but the arguments require process-creation telemetry.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.