SC-200 Lateral movement Practice Question
You are a threat hunter and you want to identify potential lateral movement in your environment. Which Microsoft Defender XDR hunting table would you query to find network connections from a compromised workstation to other internal devices?
⚠ Common exam trap
SC-200 often tests whether candidates can distinguish between endpoint telemetry tables by their core data type, and the trap is confusing process execution (DeviceProcessEvents) with network connection activity (DeviceNetworkEvents) when hunting for lateral movement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceNetworkEvents
DeviceNetworkEvents is the correct table because it records network connection telemetry from Defender for Endpoint sensors, including outbound and inbound connections, remote IPs, ports, and the initiating process. Lateral movement typically manifests as SMB, RDP, WinRM, or other internal connections from a compromised host to peer systems, all of which appear in this table. Querying DeviceNetworkEvents lets you correlate the initiating process with remote endpoints to spot anomalous east-west traffic. The other tables capture process, logon, or file activity, not raw network connection details.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DeviceProcessEvents
Why it's wrong here
Process creation records capture command lines and parent-child relationships, not network sockets, so lateral movement over SMB or RDP leaves no destination address here. It is tempting because process lineage often reveals suspicious tooling, and DeviceProcessEvents would be the correct table when hunting for malicious executables or encoded PowerShell.
- ✗
DeviceLogonEvents
Why it's wrong here
Logon events record authentication attempts and session types, not the network connections carrying that traffic, so the destination device is absent. It is tempting because pass-the-hash and remote interactive logons appear here, making DeviceLogonEvents correct when hunting credential-based access rather than connection metadata.
- ✓
DeviceNetworkEvents
Why this is correct
DeviceNetworkEvents records inbound and outbound network connections with remote IP addresses, ports and initiating processes, so querying it reveals a compromised workstation connecting to other internal devices — exactly the lateral movement indicator the hunt requires.
- ✗
DeviceFileEvents
Why it's wrong here
File events log creation, modification and deletion activity, so outbound connections to internal hosts never appear. It is tempting because dropped payloads and ransomware notes surface in DeviceFileEvents, making it the right table when investigating file-based artefacts rather than network reachability.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.