hardMultiple Choice
SC-200 Practice Question: In Microsoft 365 Defender advanced hunting, an…
In Microsoft 365 Defender advanced hunting, an analyst is investigating a case where a user's device was compromised via a malicious base64-encoded PowerShell script. The analyst wants to find all processes that were created by this script by decoding the command line. Which KQL function should be applied to the ProcessCommandLine column in the DeviceProcessEvents table?
⚠ Common exam trap
The trap here is that Microsoft tests whether candidates know the exact KQL function name `base64_decode_tostring()` versus common but incorrect variations like `decode_base64()` or `parse_base64()`, which are not part of the Kusto Query Language.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
base64_decode_tostring(ProcessCommandLine)
The correct KQL function to decode a Base64-encoded string into a readable text format in Microsoft 365 Defender advanced hunting is `base64_decode_tostring()`. This function takes a string column (like ProcessCommandLine) and returns the decoded plaintext, allowing the analyst to see the actual PowerShell commands executed. The other options are either invalid KQL functions or do not exist in the Kusto Query Language used in advanced hunting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
base64_decode_tostring(ProcessCommandLine)
Why this is correct
base64_decode_tostring(ProcessCommandLine) is a valid KQL function in Microsoft 365 Defender advanced hunting. It takes a base64-encoded string as its input and returns the decoded plain-text string. In PowerShell obfuscation, attackers frequently encode malicious command lines using base64, so applying this function reveals the actual command that was executed, enabling analysts to inspect the true intent and detect malicious behavior.
- ✗
parse_base64(ProcessCommandLine)
Why it's wrong here
parse_base64(ProcessCommandLine) is not a recognized KQL function in Microsoft 365 Defender advanced hunting. KQL provides dedicated base64 transformation functions such as base64_decode_tostring and base64_encode_tostring, but parse_base64 does not exist. The term 'parse' in KQL usually refers to functions like parse_json or parse_string that interpret structured data, not decode base64, so this would result in a syntax error or an unrecognized function failure.
- ✗
decode_base64(ProcessCommandLine)
Why it's wrong here
decode_base64(ProcessCommandLine) is not the correct name for the KQL function. Some programming languages or tools use functions like decode_base64, but KQL uses base64_decode_tostring. The KQL function name explicitly includes the output type ('tostring') to clarify that it returns a string, and using the shortened or differently ordered name decode_base64 is invalid and will be rejected by the query engine as an unknown function.
- ✗
convertstring(ProcessCommandLine, 'base64')
Why it's wrong here
convertstring(ProcessCommandLine, 'base64') is not a valid KQL function in Microsoft 365 Defender advanced hunting. While .NET classes like System.Convert provide ToBase64String and FromBase64String methods, KQL does not use a convertstring function for this purpose. To decode base64, you must use the specific KQL function base64_decode_tostring, which explicitly takes a single string argument; any other syntax will cause an error in the query.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.