SC-200 Practice Question 3828
Exam: SC-200
Domain: Perform threat hunting
Difficulty: easy
In Microsoft Defender XDR Advanced Hunting, which table contains telemetry regarding file modifications, renames, creations, and deletions on Windows and Linux endpoints?
Answer Options
A
The DeviceFileEvents table
B
The DeviceNetworkEvents table
C
The DeviceInfo table
D
The CloudAppEvents table
Correct Answer
A: The DeviceFileEvents table
Explanation
The DeviceFileEvents table logs all file system changes, file creations, deletions, and file overwrite actions captured by the endpoint sensor.