SC-200 Practice Question 3815
Exam: SC-200
Domain: Perform threat hunting
Difficulty: easy
You are performing a threat hunt using Kusto Query Language (KQL) in Microsoft Defender XDR. You need to identify endpoints where `cmd.exe` or `powershell.exe` was launched by `winword.exe`. Which Advanced Hunting table should you query?
Answer Options
A
The DeviceProcessEvents table
B
The DeviceLogonEvents table
C
The DeviceNetworkInfo table
D
The AlertEvidence table
Correct Answer
A: The DeviceProcessEvents table
Explanation
The DeviceProcessEvents table records process creation events, parent process relationships, and command-line execution parameters across all enrolled endpoints.