Exam SC-200 topic 4 question 18 discussion

The second option is correct. Indeed, "join" is by default "innerunique" which is more optimal than "leftouter" (Answer A). Ref: https://learn.microsoft.com/en-us/kusto/query/join-operator?view=microsoft-fabric#returns Therefore, B is the more optimal choice.

A: Returns all Graph rows, even non-risky, increasing volume—doesn’t minimize effectively. B: Returns only rows where Graph activity matches risky users—minimizes volume. C: Wrong table (AADUserRiskEvents vs. AADRiskyUsers)—misses “risky users” requirement D: Wrong table (AADUserRiskEvents) and inefficient—doesn’t minimize data. My answer: B

Why lookup kind=leftouter? lookup is more efficient than join when you have a small reference table (like a list of risky users). lookup kind=leftouter ensures that only relevant columns are added without duplicating redundant rows from the large table (MicrosoftGraphActivityLogs). This minimizes the amount of data returned, which is exactly what is required

A = Ensures you get a comprehensive view of all activity logs, with additional information about risky users where available. B = Needs to minimize the volume of data returned, additional filters like limit 1000. D = This way, you can analyze the activities of users flagged with risk events and gain insights into their behavior. I would say D