Exam SC-200 topic 3 question 21 discussion

Actual exam question from Microsoft's SC-200

Question #: 21
Topic #: 3

You plan to create a custom Azure Sentinel query that will track anomalous Azure Active Directory (Azure AD) sign-in activity and present the activity as a time chart aggregated by day.
You need to create a query that will be used to display the time chart.
What should you include in the query?

A. extend
B. bin
C. makeset
D. workspace

Show Suggested Answer

Suggested Answer: B 🗳️

by Task at May 30, 2021, 10:11 a.m.

Comments

Submit Cancel

werbinich

Highly Voted 2 years, 10 months ago

Grouping results can also be based on a time column, or another continuous value. Simply summarizing by TimeGenerated, though, would create groups for every single millisecond over the time range, because these are unique values. To create groups that are based on continuous values, it's best to break the range into manageable units by using bin. Thus correct answer.

upvoted 16 times

...

Murtuza

Most Recent 7 months, 2 weeks ago

Perf | where TimeGenerated > ago(7d) | where Computer == "ContosoAzADDS2" | where CounterName == "Available MBytes" | summarize avg(CounterValue) by bin(TimeGenerated, 1h)

upvoted 1 times

...