SC-200 Practice Question 3817
Exam: SC-200
Domain: Perform threat hunting
Difficulty: hard
You are hunting for anomalous outbound network connections in Microsoft Defender XDR. You want to join process creation telemetry with network connection telemetry. Which common column serves as the primary key to join `DeviceProcessEvents` and `DeviceNetworkEvents`?
Answer Options
A
DeviceId, ReportId, and InitiatingProcessToken / ProcessToken
B
Computer monitor resolution and color depth
C
User email password hashes
D
The server serial number
Correct Answer
A: DeviceId, ReportId, and InitiatingProcessToken / ProcessToken
Explanation
The ActionType and DeviceId columns combined with ReportId or ProcessToken / InitiatingProcessToken uniquely correlate process executions with outgoing network connections.