Exam SC-200 topic 7 question 27 discussion

Actual exam question from Microsoft's SC-200

Question #: 27
Topic #: 7

HOTSPOT
-

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.

You discover a malicious process that was initiated by a file named File1.exe on a device named Device1.

You need to create a KQL query that will identify when File1.exe was created. The solution must meet the following requirements:

• Return the FileName, InitiatingProcessFileName, and InitiatingProcessCommandLine columns.
• Minimize the volume of data returned.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.