Exam SC-200 topic 7 question 18 discussion

Actual exam question from Microsoft's SC-200

Question #: 18
Topic #: 7

HOTSPOT
-

You have an Azure subscription.

You have a Microsoft Sentinel workbook that contains the following text parameters:

• text1
• grouptime1

You need to display the count of security alerts. The count must be filtered based on the text1 parameter and grouped by the grouptime1 parameter.

How should you complete the KOL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by a_kto_to at March 26, 2025, 4:22 p.m.

Comments

Submit Cancel

a_kto_to

1 month, 1 week ago

ChatGTP: SecurityAlert | where AlertName contains '{text1}' | summarize Count = count() by bin(TimeGenerated, {grouptime1})

upvoted 2 times

Adel614

2 weeks, 6 days ago

Your answer is correct. It is double-confirmed by this Microsoft documentation page: https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-dropdowns#in-kql Extract: """In the KQL editor, enter this snippet: requests | where name == '{RequestName}' | summarize Requests = count() by bin(timestamp, 1h) The snippet expands on query evaluation time to: requests | where name == 'GET Home/Index' | summarize Requests = count() by bin(timestamp, 1h)"""

upvoted 1 times

...

pjn

3 weeks, 5 days ago

Exactly, it should be single quotes, wierd question or wrongly written answers

upvoted 2 times

...

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam

Exam SC-200 topic 7 question 18 discussion

Comments

a_kto_to

Adel614

pjn

SY0-701