ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam
Go to Exam

Exam SC-200 topic 7 question 33 discussion

Actual exam question from Microsoft's SC-200
Question #: 33
Topic #: 7
[All SC-200 Questions]

HOTSPOT
-

You have a Microsoft Sentinel workspace named Workspace1.

You need to create a custom workbook in Workspace1. Workspace1 must display a time chart that shows failed Microsoft Entra sign-ins from the past seven days. The solution must ensure that the chart includes a count of failed sign-ins for each day.

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer Hide Answer
Suggested Answer:
by Krayzr at June 13, 2025, 9:12 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Krayzr
1 day, 18 hours ago
make-series | default=0 on TimeGenerated step 1d SigninLogs | where TimeGenerated > ago(7d) | where ResultType != 0 | extend Count = 1 | make-series Count = count() default=0 on TimeGenerated step 1d | render timechart
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel