Exam SC-200 topic 7 question 5 discussion

Actual exam question from Microsoft's SC-200

Question #: 5
Topic #: 7

HOTSPOT
-

You have a Microsoft 365 subscription.

You need to identify all the security principals that submitted requests to change or delete groups.

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by teho99 at April 29, 2024, 8:53 p.m.

Comments

Submit Cancel

Edindude

Highly Voted 6 months, 1 week ago

MicrosoftGraphActivities | where RequestUri contains '/group' | where RequestMethod != "GET" | project AppId, UserId, ServicePrincipalId

upvoted 7 times

...

smanzana

Most Recent 1 year ago

Correct

upvoted 2 times

...

teho99

1 year, 3 months ago

First I think it's POST req, but then i see "identify submitted requests" and now I know answer is GET.

upvoted 4 times

OneplusOne

2 months, 3 weeks ago

GET is the correct choice The exclamation mark means exclude. So this query returns all activities related to groups and all methods besides GET.

upvoted 2 times

...

kukuliquid

1 year, 3 months ago

The original answer is correct but this explanation is false RequestMethod DIFFERS FROM "GET" meaning it will return requests that are not simple get, but can be POST, PUT, UPDATE, DELETE...

upvoted 7 times

QzLP2P

3 months ago

UPDATE is not a valid http, it's PUT or PATCH

upvoted 1 times

...