SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Exhibit
KQL Query: DeviceFileEvents | where Timestamp > ago(7d) | where FileName contains "confidential" | where FileSize > 1000 | summarize Count = count() by DeviceName, ActionType | where Count > 5
Refer to the exhibit. The KQL query is run in Microsoft Defender for Endpoint. What is the purpose of this query?
⚠ Common exam trap
Watch out — candidates often assume the query lists all file creation events (Option D) or detects malware (Option C), but the key is the `SensitivityLabel` filter, which directly ties to data protection and DLP, not general file events or malware.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To find devices with a high number of operations on potentially sensitive files.
The KQL query filters for `DeviceFileEvents` where `SensitivityLabel` is not empty, indicating files with sensitivity labels applied (e.g., confidential, internal). It then summarizes the count of operations per device and orders by the highest count. This identifies devices with a high number of operations on potentially sensitive files, aligning with data loss prevention (DLP) monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To find devices with a high number of operations on potentially sensitive files.
Why this is correct
The KQL query specifically targets DeviceFileEvents where the FileName contains "confidential," indicating potentially sensitive data. By then summarizing the count() of these events per DeviceName and filtering for EventCount > 5, the query effectively identifies devices exhibiting an unusually high volume of interactions with these specific files, which could signify suspicious activity or data exfiltration attempts.
- ✗
To list all devices that have files named confidential.
Why it's wrong here
This query does not list all devices with files named "confidential." While it initially filters for such files, the subsequent summarize operation aggregates events by DeviceName and the final where EventCount > 5 clause explicitly filters out devices that have fewer than six operations on those confidential files. Therefore, it only presents a subset of devices with significant activity, not every device possessing such files.
- ✗
To detect malware on devices.
Why it's wrong here
The KQL query lacks specific indicators typically used for malware detection. It focuses on file names containing "confidential" and event counts, rather than looking for known malicious file hashes, suspicious process behaviors, network connections to command-and-control servers, or specific ActionType values associated with malware execution or persistence mechanisms.
- ✗
To list all file creation events.
Why it's wrong here
The query does not list all file creation events. Firstly, it operates on DeviceFileEvents, which encompasses various file actions (creation, modification, deletion, access), not exclusively creations. Secondly, the query applies a stringent filter based on FileName containing "confidential" and then summarizes the event counts, rather than returning individual event records, let alone all of them.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise security solution designed to protect devices from cyber threats using behavioral analysis, machine learning, and automated investigation.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.