SC-200 Practice Question 3774
Exam: SC-200
Domain: Respond to security incidents
Difficulty: medium
During a threat investigation, an analyst notices that an endpoint has been communicating with a known malicious C2 IP address. How can the analyst verify which process initiated that connection?
Answer Options
A
DeviceNetworkEvents filtered by RemoteIP to inspect InitiatingProcessFileName
B
DeviceLogonEvents filtered by AccountName
C
DeviceFileEvents filtered by FolderPath
D
SigninLogs filtered by AppDisplayName
Correct Answer
A: DeviceNetworkEvents filtered by RemoteIP to inspect InitiatingProcessFileName
Explanation
Query the DeviceNetworkEvents table in Advanced Hunting using KQL, filtering by RemoteIP to identify the initiating InitiatingProcessFileName and InitiatingProcessCommandLine.