Exam SC-200 topic 3 question 86 discussion

HOTSPOT
-

You have an Azure subscription that contains a Microsoft Sentinel workspace.

You need to create a hunting query using Kusto Query Language (KQL) that meets the following requirements:

• Identifies an anomalous number of changes to the rules of a network security group (NSG) made by the same security principal.
• Automatically associates the security principal with a Microsoft Sentinel entity.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Suggested Answer: