SC-200 Query Practice Questions

You need to create an advanced hunting query to investigate the executive team issue. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Match each item to its target.

Correct answer: Table = CloudAppEvents; Aggregation = count()

You need to complete the query for failed sign-ins to meet the technical requirements. Where can you find the column name to complete the where clause?

• AA. Security alerts in Azure Security Center
• BB. Activity log in Azure
• CC. Azure Advisor
• DD. the query windows of the Log Analytics workspace

You need to implement the query for Workbook1 and Webapp1. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Match each item to its target.

Correct answer: Data source to query = JSON; On Webapp1 = Enable Cross-Origin Resource Sharing (CORS).