HOTSPOT You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You discover a malicious process that was initiated by a file named File1.exe on a device named Device1. You need to create a KQL query that will identify when File1.exe was created. The solution must meet the following requirements:
• Return the FileName, InitiatingProcessFileName, and InitiatingProcessCommandLine columns.
• Minimize the volume of data returned. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Select one answer.
Purchase Full Access to view answer options & explanation
The first 125 questions in this bank are completely free. Unlock Full Access on the exam page to view all answer choices, verified answers, explanations, and community discussions for all 415 questions.
