ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam
Go to Exam

Exam SC-200 topic 7 question 1 discussion

Actual exam question from Microsoft's SC-200
Question #: 1
Topic #: 7
[All SC-200 Questions]

HOTSPOT
-

You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1.

You deploy Advanced Security Information Model (ASIM) authentication parsers to WS1.

You need to use the parsers to query the authentication events generated by User1 during the last 24 hours. The solution must maximize the performance of the query.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer Hide Answer
Suggested Answer:
by renrenren at March 11, 2024, 12:10 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
luisM14
Highly Voted 1 year, 1 month ago
Wrong. Correct is: imAuthentication (targetusername_has = 'johndoe', starttime = ago(1d), endtime=now()) https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-authentication
upvoted 26 times
Tuitor01
5 months ago
I second this one for a very logical reason AS parsers are parameterless parsers, meaning they don't have filters.
upvoted 1 times
...
...
akamex
Highly Voted 1 year, 1 month ago
Query provided in Microsoft Learn. imAuthentication (targetusername_has = 'johndoe', starttime = ago(1d), endtime=now()) https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-authentication
upvoted 9 times
...
Optimizor_IT
Most Recent 3 weeks, 5 days ago
imAuthentication(targetusername_has='user1', starttime=ago(1d), endtime=now())
upvoted 1 times
...
smanzana
9 months, 2 weeks ago
imAuthentication targetusername_has
upvoted 3 times
...
Avaris
10 months, 3 weeks ago
answer from ghagpt is ASimAuthentication | targetusername_has = 'user1', starttime = ago(1d), endtime=now() so the given answer is correct
upvoted 1 times
Optimizor_IT
3 weeks, 5 days ago
If you think that everybody here is wrong just because GPT said so, I invite you to take a certification renewal using GPT. I did, just for testing, since you can retake it as many times as you want. Got 42 points.
upvoted 1 times
...
...
renrenren
1 year, 1 month ago
Correct https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-authentication
upvoted 1 times
renrenren
11 months, 3 weeks ago
should be imAuthentication & targetusername_has
upvoted 4 times
...
meg4321
1 year, 1 month ago
According to the link it should be imAuthentication: " imAuthentication (targetusername_has = 'johndoe', starttime = ago(1d), endtime=now())"
upvoted 8 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago