SC-200 Practice Question 3838
Exam: SC-200
Domain: Perform threat hunting
Difficulty: easy
Which table in Advanced Hunting stores telemetry regarding DNS queries, name resolution lookups, and reverse DNS requests initiated by processes on endpoints?
Answer Options
A
The DeviceEvents table (with ActionType = "DnsQuery") or DnsEvents
B
The DeviceProcessEvents table
C
The SecurityAlert table
D
The EmailUrlInfo table
Correct Answer
A: The DeviceEvents table (with ActionType = "DnsQuery") or DnsEvents
Explanation
The DeviceEvents table (with ActionType = "DnsQuery") or the dedicated DnsEvents table captures domain name resolution telemetry across client devices.