Exam SC-200 All Questions

View all questions & answers for the SC-200 exam

Exam SC-200 topic 7 question 1 discussion

Actual exam question from Microsoft's SC-200

Question #: 1
Topic #: 7

HOTSPOT
-

You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1.

You deploy Advanced Security Information Model (ASIM) authentication parsers to WS1.

You need to use the parsers to query the authentication events generated by User1 during the last 24 hours. The solution must maximize the performance of the query.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by renrenren at March 11, 2024, 12:10 p.m.

Comments

Submit Cancel

luisM14

Highly Voted 1 year, 2 months ago

Wrong. Correct is: imAuthentication (targetusername_has = 'johndoe', starttime = ago(1d), endtime=now()) https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-authentication

upvoted 26 times

Tuitor01

6 months, 3 weeks ago

I second this one for a very logical reason AS parsers are parameterless parsers, meaning they don't have filters.

upvoted 1 times

...

akamex

Highly Voted 1 year, 3 months ago

Query provided in Microsoft Learn. imAuthentication (targetusername_has = 'johndoe', starttime = ago(1d), endtime=now()) https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-authentication

upvoted 9 times

...

Optimizor_IT

Most Recent 2 months, 2 weeks ago

imAuthentication(targetusername_has='user1', starttime=ago(1d), endtime=now())

upvoted 2 times

...

smanzana

11 months, 1 week ago

imAuthentication targetusername_has

upvoted 3 times

...

Avaris

1 year ago

answer from ghagpt is ASimAuthentication | targetusername_has = 'user1', starttime = ago(1d), endtime=now() so the given answer is correct

upvoted 1 times

Optimizor_IT

2 months, 2 weeks ago

If you think that everybody here is wrong just because GPT said so, I invite you to take a certification renewal using GPT. I did, just for testing, since you can retake it as many times as you want. Got 42 points.

upvoted 1 times

...

renrenren

1 year, 3 months ago

Correct https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-authentication

upvoted 1 times

renrenren

1 year, 1 month ago

should be imAuthentication & targetusername_has

upvoted 4 times

...

meg4321

1 year, 3 months ago

According to the link it should be imAuthentication: " imAuthentication (targetusername_has = 'johndoe', starttime = ago(1d), endtime=now())"

upvoted 8 times

...