Question 25

Question

HOTSPOT You need to create an advanced hunting query to investigate the executive team issue. How should you complete the query? To answer, select the appropriate options in the answer area.

Noah F. · Answer

DeviceLogonEvents again. For tracking exec team logons, that's the usual hunting table, since it records all sign-in attempts. Unless they specifically say they want to see process activity, this fits best. Open to being corrected if I missed some trick in the screenshot though.

Amelia Y. · Answer

DeviceLogonEvents, unless they were asking about specific process starts or the table wasn’t populated (seen that in some tenants).

Morgan · Answer

DeviceLogonEvents tableI've seen this pattern in other practice sets and on exam reports. You want to target logon activity for specific users, so filtering the DeviceLogonEvents makes sense. Pretty sure this is the right table here but if anyone has a different take let me know.

Liam J. · Answer

DeviceLogonEventsLove how clear the screenshot is for this one.

Microsoft SC-200 Security Operations Analyst Real Exam Questions [October 2026 Update] Quiz

Premium Access Includes