Exam NSE7_ADA-6.3 topic 1 question 32 discussion

group by. only tom

Study Guide p.204 when using the "group by" & aggregate, for the counter to go up, every group-by attribute must match, only tom has 3x the same source IP - reporting IP - Username Admin has 2x the same source but in the third time he uses another source IP which will create a new entry with the count of 1 (because of the new source)

C: Tom, because: For Sarah, we only have one record. An aggregation will never count 3 or more. For Jan, we have only two records. Same applies here. For Admin, we have a total of three entries. But the last entry has the source IP 203.0.113.5, instead of 203.0.113.4 like the other two. The group by will also not generate more than 2 matched events. Only Tom has three entries where there are the same source IP (198.51.100.46) and the same reporting IP (10.0.2.10)