SC-200 Certification Practice Question #6

Question

You have a Microsoft 365 E5 subscription.
You plan to perform cross-domain investigations by using Microsoft 365 Defender.
You need to create an advanced hunting query to identify devices affected by a malicious email attachment.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

The task correlates email attachments with on-device file activity by matching SHA256, which is exactly an inner `join` — confirming dropdown 1. The official MS Learn sample query "Check if files from a known malicious sender are on your devices" uses `project` both inside the join subquery and in the final statement, so the documented and ExamTopics "given" answer is join / project / project, which is what the most-voted comment (teehex, 👍 55) reproduces. The notable community split is real: PJR (👍 39), Metasploit (👍 13), and Shubham020 tested in live tenants and found that because *this question's screenshot* drops DeviceName/DeviceId from the inner `project FileName, SHA256`, the final `project` of DeviceName/DeviceId throws a "Failed to resolve" error, so they substitute `extend` (which appends columns) to make it execute. That is a live-execution workaround for a query the exam abbreviated, not the documented form. Following the methodology (MS Learn as the authority and the official Suggested Answer), the keyed answer is join / project / project; confidence is lowered to 78 to document the genuine project-vs-extend conflict driven by the truncated query in the exhibit.

More SC-200 practice questions