SC-200 Perform threat hunting Practice Question
Which TWO tables in Microsoft Defender XDR advanced hunting are most useful for detecting data exfiltration attempts? (Select two.)
⚠ Common exam trap
SC-200 often tests whether candidates can map a threat scenario to the correct telemetry table — the trap is choosing process or email tables because they are familiar, when exfiltration is best evidenced by network and cloud activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceNetworkEvents
DeviceNetworkEvents (B) is correct because it records outbound network connections from endpoints, including RemoteIP, RemotePort, RemoteUrl, and bytes sent/received, which lets you spot anomalous transfers to external or untrusted destinations indicative of exfiltration. CloudAppEvents (C) is correct because it captures activity in cloud applications and services (for example file downloads, sharing, and uploads via Microsoft 365 and other connected apps), which is where data is commonly staged and moved out. DeviceProcessEvents (A) shows process creation and command lines, which may reveal staging or archiving tools but not the actual data transfer, so it is less directly useful. EmailEvents (D) covers mail flow and delivery metadata, which is relevant to phishing or email-based leaks but not general exfiltration channels. DeviceInfo (E) is only static asset and configuration inventory, so it contains no transfer activity to detect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DeviceProcessEvents
Why it's wrong here
Process creation, not network.
- ✓
DeviceNetworkEvents
Why this is correct
DeviceNetworkEvents records outbound connections with remote IP, port and initiating process, exposing transfers to unfamiliar destinations or large uploads. That network-layer visibility is what reveals exfiltration traffic leaving endpoints, complementing cloud-side logging rather than duplicating it.
- ✓
CloudAppEvents
Why this is correct
CloudAppEvents captures user and admin activity across Microsoft 365 and connected cloud apps, including file downloads, sharing and mass access. Exfiltration frequently moves data through sanctioned cloud services, so this table exposes the application-layer actions that endpoint and network telemetry alone would miss.
- ✗
EmailEvents
Why it's wrong here
Email traffic, not necessarily exfiltration.
- ✗
DeviceInfo
Why it's wrong here
Device metadata, not network activity.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.