Microsoft Discussions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam

Go to Exam

Exam SC-200 topic 3 question 57 discussion

Actual exam question from Microsoft's SC-200

Question #: 57
Topic #: 3

[All SC-200 Questions]

HOTSPOT
-

You have a Microsoft Sentinel workspace.

You need to create a KQL query that will identify successful sign-ins from multiple countries during the last three hours.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by ACSC at Jan. 22, 2023, 1:26 p.m.

Comments

Submit Cancel

ACSC

Highly Voted 2 years, 5 months ago

Correct. https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimAuthentication/imAuthSigninsMultipleCountries.yaml

upvoted 19 times

...

smanzana

Most Recent 11 months, 2 weeks ago

Correct

upvoted 1 times

...

Murtuza

1 year, 6 months ago

The key word in the question " sign in " implies authentication so its a given there

upvoted 1 times

...

chepeerick

1 year, 8 months ago

Correct Option

upvoted 1 times

...

donathon

1 year, 11 months ago

query: | let timeframe = ago(3h); let threshold = 2; imAuthentication | where TimeGenerated > timeframe | where EventType == 'Logon' and EventResult == 'Success' | where isnotempty(SrcGeoCountry) | summarize

upvoted 1 times

danb67

1 year, 8 months ago

agreed answer is correct

upvoted 1 times

...

...

JoeP1

1 year, 11 months ago

The ScrGeoCountry is obvious from the isnotempty() 2 lines above, but imAuthentication requires ASIM knowledge.

upvoted 3 times

...