Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Question 17 of 125
Free Preview · 125 of 415 · questions 1–125 of 415 are free. Sign up free to sync your progress across devices.
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
Answer is correct. Here is a brief explanation of how this query works: The where clause filters the EmailAttachmentInfo table to only include attachments sent by the specified sender and that have a non-empty SHA256 hash value. This effectively filters the results to only include attachments from the specified sender and that have a known hash value. The join operator combines the results of the previous step with the results of a second query that selects the DeviceFileEvent table and projects the FileName, SHA256, DeviceName, and DeviceId fields. This effectively creates a join between the two tables based on the SHA256 field, linking the attachments with file events on devices. The project operator selects the desired fields from the joined results and includes them in the final output. This query will work in both Microsoft Defender and Azure Sentinel, as it is a valid advanced hunting query in both platforms.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
On exam, December 2025
Correct
Correct
The answer is correct. SHA256 and SHA256. Check if files from a known malicious sender are on your devices https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails-devices?view=o365-worldwide#check-if-files-from-a-known-malicious-sender-are-on-your-devices