Exam SC-200 topic 5 question 28 discussion

Actual exam question from Microsoft's SC-200

Question #: 28
Topic #: 5

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.

You have a custom detection rule named Rule1 that generates an alert if more than five antivirus detections are identified on a device. Rule1 has a lookback period of 12 hours.

You need to change the lookback period to 48 hours.

What should you modify for Rule1?

A. the scope
B. the summarize operator of the KQL query
C. the frequency
D. the where operator of the KQL query

Show Suggested Answer

Suggested Answer: C 🗳️

by Krayzr at June 13, 2025, 8:13 p.m.

Comments

Submit Cancel

Krayzr

1 day, 19 hours ago

Selected Answer: D

D. the WHERE operator of the KQL query. To change the lookback period of a custom detection rule, you must modify the time filter within the Kusto Query Language (KQL) query itself. This is typically done using the where operator combined with the ago() function. For example, the original query for Rule1 would contain a line similar to this: | where Timestamp > ago(12h)

upvoted 1 times

...

Most Voted

Save Cancel

Loading ...