Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.
```kusto
AlertEvidence
| where Timestamp > ago(1h)
| where AlertId == "alert-5678"
| where EntityType == "File"
| project FileName, FilePath, SHA256
```

You are investigating an alert in Microsoft 365 Defender. The KQL query in the exhibit retrieves evidence for alert-5678. What type of entities does this query filter for?

⚠ Common exam trap

A common mix-up: candidates confuse file hash filtering with process or network entity identification, but Microsoft 365 Defender uses distinct identifiers (SHA256 for files, PID for processes, IP/URL for network) that are explicitly tied to the entity type in the schema.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

File entities

The KQL query filters for evidence related to alert-5678 by specifying a hash value (SHA256) of a file. In Microsoft 365 Defender, file entities are uniquely identified by their hash values, such as SHA256, SHA1, or MD5. The query uses the `where` clause to match the specific file hash, confirming that the filtered entities are file entities.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Registry entities
Why it's wrong here
This option is incorrect because the KQL query explicitly uses `EntityType == 'File'` to filter for file-related events. To investigate registry entities, the query would need to specify `EntityType == 'Registry'`, targeting events such as registry key modifications, creations, or deletions. The current filter directs the investigation away from the Windows Registry, focusing solely on file system activities.
✗
Process entities
Why it's wrong here
This option is incorrect as the KQL query's `EntityType` filter is set to `'File'`, indicating a focus on file system activities. To analyze process entities, such as process creation, termination, or parent-child relationships, the query would specifically require `EntityType == 'Process'`. The provided filter therefore excludes any data pertaining to active or terminated processes from the results, making it irrelevant for process-based investigations.
✗
Network entities
Why it's wrong here
This option is incorrect because the KQL query explicitly filters for `EntityType == 'File'`, which pertains to file system operations, not network communications. To investigate network entities like IP connections, DNS queries, or network sessions, the query would need to specify `EntityType == 'Network'` or other relevant network-specific entity types. The current filtering criteria would not return any network-related activity, making this option unsuitable for network-centric analysis.
✓
File entities
Why this is correct
This option is correct because the KQL query explicitly includes the condition `EntityType == 'File'`, which is designed to retrieve data specifically related to file system events. This filter ensures that the investigation focuses on activities such as file creation, modification, deletion, or access attempts on endpoints. Therefore, the alert evidence being examined directly corresponds to file entities within the Microsoft 365 Defender data schema, making this the appropriate choice.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question