Exam SC-200 topic 3 question 93 discussion

Actual exam question from Microsoft's SC-200

Question #: 93
Topic #: 3

HOTSPOT
-

You have a Microsoft Sentinel workspace that contains a custom workbook.

You need to query the number of daily security alerts. The solution must meet the following requirements:

• Identify alerts that occurred during the last 30 days.
• Display the results in a timechart.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by jr_cyber at Oct. 10, 2023, 4:25 p.m.

Comments

Submit Cancel

Krayzr

2 months, 3 weeks ago

Given Answer Correct SecurityAlert | where TimeGenerated >= ago(30d) | summarize count() by ProviderName, bin(TimeGenerated, 1d) | render timechart

upvoted 2 times

...

g_man_rap

1 year ago

summarize: This function is used to aggregate data based on specified criteria. In this case, you want to count the number of security alerts by day. The summarize function will group and aggregate the results by the TimeGenerated field. bin: The bin function is used to group the TimeGenerated values into 1-day intervals. This allows the query to generate counts of security alerts for each day within the specified 30-day period.

upvoted 2 times

...