Exam SC-200 topic 3 question 86 discussion

Actual exam question from Microsoft's SC-200

Question #: 86
Topic #: 3

HOTSPOT -

You have an Azure subscription that contains a Microsoft Sentinel workspace.

You need to create a hunting query using Kusto Query Language (KQL) that meets the following requirements:

• Identifies an anomalous number of changes to the rules of a network security group (NSG) made by the same security principal.
• Automatically associates the security principal with a Microsoft Sentinel entity.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by Fez786 at Sept. 9, 2023, 7:05 a.m.

Comments

Submit Cancel

Anil0512

Highly Voted 1 year, 9 months ago

Correct Answer are. AzureActivity & Extend.

upvoted 20 times

danb67

1 year, 8 months ago

Agreed.

upvoted 1 times

...

Anil0512

1 year, 9 months ago

AzureActivity | where OperationNameValue contains "..."

upvoted 1 times

...

chepeerick

Highly Voted 1 year, 8 months ago

Azure and only extend can be used as = is used instead of ==

upvoted 7 times

...

OneplusOne

Most Recent 1 month, 1 week ago

For who wants to run the query against AI: Explain AzureActivity | where OperationNameValue in~ ("Microsoft.Network/networkSecurityGroups/securityRules/write") | where ActivityStatusValue == "Succeeded" | make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago 7d), now (), 1d) by Caller | extend timestamp = todatetime(EventSubmissionTimestamp[0]) I extend AccountCustomEntity = Caller

upvoted 1 times

...