SC-200 Perform threat hunting Practice Question
Your organization uses Microsoft Defender XDR for threat hunting. You suspect a threat actor is using scheduled tasks for persistence. Which hunting query would you use in Microsoft 365 Defender advanced hunting to find newly created scheduled tasks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeviceEvents | where ActionType == 'ScheduledTaskCreated'
Advanced hunting uses the DeviceEvents table to capture various security events, including scheduled task creation via the 'ScheduledTaskCreated' action type. Option A is correct because DeviceEvents with ActionType 'ScheduledTaskCreated' directly identifies newly created scheduled tasks. Option B (DeviceRegistryEvents) is incorrect because it captures registry modifications, and while scheduled tasks are stored in the registry, querying for 'Tasks' in the registry key is too broad and not specific to creation. Option C (DeviceProcessEvents) is incorrect because 'schtasks.exe' is the command-line tool used to create scheduled tasks, but querying for process events would capture executions rather than the actual creation of tasks, and it may miss tasks created via other methods. Option D (DeviceFileEvents) is incorrect because it tracks file operations, and scheduled tasks are not typically represented as files in a folder; the 'Tasks' folder path might refer to the Windows Task Scheduler library, but file events for task files (like .job files) are not the primary way to detect creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeviceEvents | where ActionType == 'ScheduledTaskCreated'
Why this is correct
DeviceEvents records endpoint telemetry from Defender for Endpoint, and its ActionType field captures ScheduledTaskCreated when a new scheduled task is registered. Filtering on that value surfaces persistence activity directly, which is exactly what the hunting scenario requires.
- ✗
DeviceRegistryEvents | where RegistryKey contains 'Tasks'
Why it's wrong here
Scheduled tasks are stored as files and registry keys, but DeviceRegistryEvents records registry modifications, not the task files themselves under C:\Windows\System32\Tasks. It is tempting because some task metadata does appear in the registry, yet DeviceFileEvents is what captures task file creation.
- ✗
DeviceProcessEvents | where FileName == 'schtasks.exe'
Why it's wrong here
Filtering on schtasks.exe captures task creation but also enumeration, deletion and query actions, and misses tasks created via the Task Scheduler COM API or PowerShell cmdlets. DeviceEvents with the ScheduledTaskCreated action gives precise creation telemetry.
- ✗
DeviceFileEvents | where FolderPath contains 'Tasks'
Why it's wrong here
DeviceFileEvents records file creation and modification, so filtering on a 'Tasks' folder path returns file activity, not scheduled task registration. It is tempting because scheduled tasks are stored as files, but DeviceEvents with the ScheduledTask action type captures task creation directly.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.