ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam
Go to Exam

Exam SC-200 topic 7 question 25 discussion

Actual exam question from Microsoft's SC-200
Question #: 25
Topic #: 7
[All SC-200 Questions]

You have a Microsoft 365 subscription.

You have the following KQL query.



You need to ensure that you can create a Microsoft Defender XDR custom detection rule by using the query.

What should you add to the query?

  • A. | summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId
  • B. | summarize (ReportId)=make_set(ReportId), count() by DeviceId
  • C. | summarize (Timestamp, DeviceName)=arg_min(Timestamp, DeviceName), count() by DeviceId
  • D. | summarize (Timestamp)=range(Timestamp), count() by DeviceId
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
by Madzius at Jan. 3, 2025, 8:07 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Madzius
Highly Voted 4 months ago
Selected Answer: A
It was om the test.
upvoted 5 times
...
a_kto_to
Most Recent 3 weeks, 2 days ago
Selected Answer: A
ChatGTP ✅ Correct answer: A. | summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago