Perform threat hunting →easyMultiple Choice

SC-200 Perform threat hunting Practice Question

You are threat hunting for indicators of compromise related to a known malware family. Which data source in Microsoft Defender XDR would provide the most direct evidence of malware execution on endpoints?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

DeviceProcessEvents

DeviceProcessEvents captures process creation events, which directly indicate malware execution. Option A is incorrect because EmailEvents only covers email data, not execution events. Option C (IdentityLogonEvents) focuses on authentication events, not process execution. Option D (DeviceNetworkEvents) shows network connections that may occur after execution, but does not directly show execution itself.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
EmailEvents
Why it's wrong here
EmailEvents records email-related events, not malware execution on endpoints.
✓
DeviceProcessEvents
Why this is correct
DeviceProcessEvents captures process creation events, which directly indicate malware execution.
✗
IdentityLogonEvents
Why it's wrong here
DeviceNetworkEvents shows network connections, which may be a consequence of execution but not direct evidence.
✗
DeviceNetworkEvents
Why it's wrong here
IdentityLogonEvents covers authentication events, not process execution.

Go deeper

SC-200 Perform threat hunting Practice Question

Why each option matters

Option-by-option breakdown

Related to this question